3be2abee1a119d0d4dd39a80d163cccf1d997126218681a27c81ac68356a4b40

Analysis

max time kernel
140s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 14:56

Target
3be2abee1a119d0d4dd39a80d163cccf1d997126218681a27c81ac68356a4b40.dll
Size 51KB
Sample240528-sbc2nshf4v
SHA256 3be2abee1a119d0d4dd39a80d163cccf1d997126218681a27c81ac68356a4b40
MD5 083f36c39ebd2ee19760ae30dc5e1bca
SHA1 8608183b94d1b3d15c328b29cf390ecb3719fe2e
SHA512 25e135335a0502a0275be006cda5763ffeeb7aa3a7b768e63587c9b81dcc0669d6011bb00b33be63e690f52d2bb5e52cb37e0219ef484a58bc079fda45c66c8c
SSDEEP 768:3Er7XR1M6t6FikUE58ozVOB+6QcXn0cE5Y18BtrEZJjuSkwFOBezBsAMC6Hh4:3EXXM2HEhzVWKtrEZFxFOBypMC6H
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1504	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 1504	5064	rundll32.exe	92
PID 5064 wrote to memory of 1504	5064	rundll32.exe	92
PID 5064 wrote to memory of 1504	5064	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3be2abee1a119d0d4dd39a80d163cccf1d997126218681a27c81ac68356a4b40.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3be2abee1a119d0d4dd39a80d163cccf1d997126218681a27c81ac68356a4b40.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4200,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:8
1⤵
PID:1716

memory/1504-0-0x0000000074F80000-0x0000000074F90000-memory.dmp

Download