92568303c5f9880d3c36c8f1e25516f1d51809598394fcc3b39f3cf36afd03d5

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-03-2024 08:35

Target

UpdateRingSettings.dll
Size

377KB
MD5

9f950504d5ea22c6f1ee20f7c2ed3b7b
SHA1

5090de783322847e6395567e7449fc4200b054a5
SHA256

37253093d3c8ed1d56b3a50f31f8944888ff38b714097637c5372a0ad19c337b
SHA512

ae80c7778304140d4476d42f6ef4439c61c2ec4ff42958007b93418a53908fb516544c57e1db99b7a6d79ae501f49c46f6636d8f967b033e744feb33879e0734
SSDEEP

6144:NUlY4DS+edXqQE0jrJdi2Jnrly7IhPdZGVTQHtjM+jlxmFdNwtRx5Kg3jcCE++Jv:NU64s6QPrzi85tdX+ExMwtjcwOcS

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

FileCoAuth.exe

pid process

2040 FileCoAuth.exe

pid	process
2040	FileCoAuth.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3968 wrote to memory of 1648	3968	rundll32.exe	rundll32.exe
PID 3968 wrote to memory of 1648	3968	rundll32.exe	rundll32.exe
PID 3968 wrote to memory of 1648	3968	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 2040	1648	rundll32.exe	FileCoAuth.exe
PID 1648 wrote to memory of 2040	1648	rundll32.exe	FileCoAuth.exe
PID 1648 wrote to memory of 2040	1648	rundll32.exe	FileCoAuth.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\UpdateRingSettings.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3968

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\UpdateRingSettings.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1648

C:\users\Admin\appdata\local\Microsoft\PlayReady\FileCoAuth.exe
"C:\users\Admin\appdata\local\Microsoft\PlayReady\FileCoAuth.exe"
3⤵
- Executes dropped EXE
PID:2040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3732 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:3460

C:\Users\Admin\AppData\Local\Microsoft\PlayReady\FileCoAuth.exe
Filesize
60KB

MD5
889b99c52a60dd49227c5e485a016679

SHA1
8fa889e456aa646a4d0a4349977430ce5fa5e2d7

SHA256
6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

SHA512
08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

Download Submit