3be37af297b190efb8db29422fb9f74e329db481d55065731a669834daa8a449

Analysis

max time kernel
139s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 15:19

Target

components/IBitCometExtension.dll
Size

1012KB
MD5

08718f3054c668a3da2f124f49e35026
SHA1

982159038a7628c4c372ac08b76edf64646f550e
SHA256

3cea824a822bb41e1b7fee01825324014ba0747d79e8800fb549957b9cbf0203
SHA512

5f0c190f5adf659d8067d5618744a98a892f6be9fa5024cde82e35edf33a09f3bc983c80f3f8ffa112c391503197d824c6fc21249e8625d2332f86ec93d8d062
SSDEEP

12288:mcNbGh/pN7wesyvh/PwizR5nn5aHamj37uyt+7pDxaB:mcVGh/pN7weNlPweReHamL7uN

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4184 wrote to memory of 4540	4184	rundll32.exe	rundll32.exe
PID 4184 wrote to memory of 4540	4184	rundll32.exe	rundll32.exe
PID 4184 wrote to memory of 4540	4184	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\components\IBitCometExtension.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4184

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\components\IBitCometExtension.dll,#1
2⤵
PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4076,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:8
1⤵
PID:2708