4cf4bb8013690787577aeff60ece8f1c12f2fcc1e16c3c5df371aa7d9cecdd36

Resubmissions

25/02/2024, 14:54

240225-r9z4esfa4v 3

25/02/2024, 14:48

240225-r6r9eaeh6z 3

Analysis

max time kernel
153s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2024, 14:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fusionsystem.dll
Size

37.4MB
MD5

66bebbb9ec465d61395c70675e77dd40
SHA1

09458b8c0b45e471029556955ba9f0dccf51cba7
SHA256

4cf4bb8013690787577aeff60ece8f1c12f2fcc1e16c3c5df371aa7d9cecdd36
SHA512

2f45720962637827bfa28f25ca08b2a9136774b0204731865fe81ff98b1fee1450ba7dcda2792da0339303d5dfbe1ab1e1c492da0748cba789a543cc428851db
SSDEEP

393216:oN537iUU+TENa2S3Ne4eYwsO8qEw7xtyyVY+QbYlS+Xxo:ozCO30bdxlQ8TXx

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 1268	2556	msedge.exe	92
PID 2556 wrote to memory of 1268	2556	msedge.exe	92
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 1432	2556	msedge.exe	93
PID 2556 wrote to memory of 4180	2556	msedge.exe	94
PID 2556 wrote to memory of 4180	2556	msedge.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fusionsystem.dll,#1
1⤵
PID:3636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffd1ad546f8,0x7ffd1ad54708,0x7ffd1ad54718
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,12413408596907747210,9746305757529520164,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,12413408596907747210,9746305757529520164,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,12413408596907747210,9746305757529520164,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12413408596907747210,9746305757529520164,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12413408596907747210,9746305757529520164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:4100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
360dd5debf8bf7b89c4d88d29e38446c

SHA1
65afff8c78aeb12c577a523cb77cd58d401b0f82

SHA256
3d9debe659077c04b288107244a22f1b315bcf7495bee75151a9077e71b41eef

SHA512
0ee5b81f0acc82befa24a4438f2ca417ae6fac43fa8c7f264b83b4c792b1bb8d4cecb94c6cbd6facc120dc10d7e4d67e014cdb6b4db83b1a1b60144bb78f7542

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6fbbaffc5a50295d007ab405b0885ab5

SHA1
518e87df81db1dded184c3e4e3f129cca15baba1

SHA256
b9cde79357b550b171f70630fa94754ca2dcd6228b94f311aefe2a7f1ccfc7b6

SHA512
011c69bf56eb40e7ac5d201c1a0542878d9b32495e94d28c2f3b480772aa541bfd492a9959957d71e66f27b3e8b1a3c13b91f4a21756a9b8263281fd509c007b

Download Submit