6163ce90823f25436f7fadb3719c70fa8d1d4c8f49d7ad45615c1e83e45aa885 | Triage

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 08:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b706db7591613dfc26c4d72ae4ae34b5.dll
Size

32KB
MD5

b706db7591613dfc26c4d72ae4ae34b5
SHA1

8e4aa17488cef256e944ac731fdd7114b8ec2534
SHA256

6163ce90823f25436f7fadb3719c70fa8d1d4c8f49d7ad45615c1e83e45aa885
SHA512

3ac454ef4a013a4b503b40d7a00c9e345b9e91485c4a47b5fff7624aa1da901c3746424a8cb7709cc62086d30ad5d04df370368a627214398375a4dc37f89f0d
SSDEEP

768:gZ2I7fc/zqbCP7yvVeiEZlhCDilRbBWbte:g0Iw/zqA7QVeiEr8OlRbBWbte

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 3928	5084	rundll32.exe	94
PID 5084 wrote to memory of 3928	5084	rundll32.exe	94
PID 5084 wrote to memory of 3928	5084	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b706db7591613dfc26c4d72ae4ae34b5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b706db7591613dfc26c4d72ae4ae34b5.dll,#1
  2⤵
  PID:3928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3776 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:3276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads