1c10cedba382981455f0fc1b5ad2f98798478837ee622fa11097a80be7b967f4

Analysis

max time kernel
141s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 06:30

Target

noinstall/autorun/dlls/MonoDataCollector64.dll
Size

220KB
MD5

6b2ce7688e20c69295307f37518c3d82
SHA1

fbabade6e6596570f47d99a7318176b784cc9950
SHA256

eb4b0f32c93ba24d84a4e45cb56abab68bc05f857217cc9319feaf1925e831fe
SHA512

6ec14e6d4cdb7d7eac3b96d8d5f8e22921d0ba3e1527ab39f934220a478305642ace3f186245aa980e07205e539c31d922fdfa2ac2046f70cd42e491044538b6
SSDEEP

3072:LxEwnfcog9mELFOMsTFTPLTuMXJPDSvky54MpOBm+k7K7Ai29QnOd8zBzf25:LxIVd6ZLTt1OvkyKMpN55i2jgxe5

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2932	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\noinstall\autorun\dlls\MonoDataCollector64.dll,#1
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4400,i,3210801877307184477,8078594481454001567,262144 --variations-seed-version --mojo-platform-channel-handle=1436 /prefetch:8
1⤵
PID:1208