d28e19ca404a4c37cad26efbce47c9a1fd1e5eb13bda710d41d3c89420e743e3

Analysis

max time kernel
125s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 22:45

Target
Primordial_crack_tg_anonteam1337.dll
Size 23.7MB
Sample240612-2phnratdna
SHA256 d28e19ca404a4c37cad26efbce47c9a1fd1e5eb13bda710d41d3c89420e743e3
MD5 dbb0aa15407e0ed9f888d7a152915a4e
SHA1 83dca5df1833fd0a53bb7ddc79696bd19150121b
SHA512 398a67c1db15e13522aa1e8827dc40ab6a740bf3b61bf616bb8091614f8942d72dbbfa6b143a1fe9154cc3358f60736bf7c49cd2bc6cf8eec98f5fe45c7b8229
SSDEEP 192:Mj3iyEXNkHz4FGtj5hWJz1jOO36rKB2tZij3MIvbk:sSjrCOJz1jRAKkijlvb
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	792	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 792	4120	rundll32.exe	91
PID 4120 wrote to memory of 792	4120	rundll32.exe	91
PID 4120 wrote to memory of 792	4120	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Primordial_crack_tg_anonteam1337.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Primordial_crack_tg_anonteam1337.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4272,i,5229431749694857451,16836185654682871752,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
1⤵
PID:988