92568303c5f9880d3c36c8f1e25516f1d51809598394fcc3b39f3cf36afd03d5 | Triage

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-03-2024 08:35

Sharing

Report Analysis Logs

General

Target

wtsapi32.dll
Size

121KB
MD5

b1d8282fddc1c1111860c4493c3347df
SHA1

1d946246771e30cf1edd4b0a9e23492c8bf3984c
SHA256

a7228c24d23b34a8c49bbf305980890b6648f5905a5b63679234e6146d7ebe02
SHA512

30240088a4000bc48a5e00b916d547145c86bb47351f7d04687f8f2f53390b824bcfb86a2478aecba2e086a61861b681d523dd932cbe4318836175d98937b63a
SSDEEP

3072:7LwqdOuKvQLH2UEXh8AdBDSKRkqKzrVXn:7LwqaKEaAGzrVXn

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

FileCoAuth.exe

pid process

2488 FileCoAuth.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4508 wrote to memory of 4544	4508	rundll32.exe	rundll32.exe
PID 4508 wrote to memory of 4544	4508	rundll32.exe	rundll32.exe
PID 4508 wrote to memory of 4544	4508	rundll32.exe	rundll32.exe
PID 4544 wrote to memory of 2488	4544	rundll32.exe	FileCoAuth.exe
PID 4544 wrote to memory of 2488	4544	rundll32.exe	FileCoAuth.exe
PID 4544 wrote to memory of 2488	4544	rundll32.exe	FileCoAuth.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\wtsapi32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4508

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\wtsapi32.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:4544

C:\users\Admin\appdata\local\Microsoft\PlayReady\FileCoAuth.exe
"C:\users\Admin\appdata\local\Microsoft\PlayReady\FileCoAuth.exe"
3⤵
- Executes dropped EXE
PID:2488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\PlayReady\FileCoAuth.exe
Filesize
60KB

MD5
889b99c52a60dd49227c5e485a016679

SHA1
8fa889e456aa646a4d0a4349977430ce5fa5e2d7

SHA256
6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

SHA512
08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

Download Submit