30c0e919cfbe8f0a830de28769654777b56373c6179704ed2b265048f4047173 | Triage

Analysis

max time kernel
142s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 18:46

Sharing

Report Analysis Logs

General

Target

ac9642fe697d0d24174b19114faa8da0.dll
Size

33KB
MD5

ac9642fe697d0d24174b19114faa8da0
SHA1

f1935b41803b54172ff5fddf1c59445ef929425e
SHA256

30c0e919cfbe8f0a830de28769654777b56373c6179704ed2b265048f4047173
SHA512

a1bf7b3ca3648bda88d5fa247b692c5885ed744611d93dafeb2f125a72e03db1b1c981c3dd19d2740a42f090a93fdf31f2d779efb9222917df364302b8bca788
SSDEEP

768:UbaJbRi37mJSLuKoGPsJwyp5zwDIXQ8rzRgiMXy:UbaRAKJRG0gIXR8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 4544	3620	rundll32.exe	92
PID 3620 wrote to memory of 4544	3620	rundll32.exe	92
PID 3620 wrote to memory of 4544	3620	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac9642fe697d0d24174b19114faa8da0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac9642fe697d0d24174b19114faa8da0.dll,#1
  2⤵
  PID:4544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3920 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:3824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads