29e9358b09925e124f56a11c085066d61370d5ae5f793d140419854d402be813 | Triage

Analysis

max time kernel
137s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-03-2024 14:59

Sharing

Report Analysis Logs

General

Target

bc182b02c0496f829ce9850c724ffbdf.dll
Size

29KB
MD5

bc182b02c0496f829ce9850c724ffbdf
SHA1

95d6e0167196bd2086db5aa1fa79a4ea2bbcf2c6
SHA256

29e9358b09925e124f56a11c085066d61370d5ae5f793d140419854d402be813
SHA512

410d6037888e53cef49ca845b5787902354a2382873f1d262705e6f99491da5b97dc8ec7ab1b7850235ae0891088b4d9b4e2ec32ff2186a003fec6fd7859bef5
SSDEEP

768:98/8grK9qjJ5dK+H9vDfFa3SBksYe62q6jkvCtAilZ:9Y8grQKxK+Zf03SKBwZ

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3768	rundll32.exe
3768	rundll32.exe
3768	rundll32.exe
3768	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3768	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 32 wrote to memory of 3768	32	rundll32.exe	94
PID 32 wrote to memory of 3768	32	rundll32.exe	94
PID 32 wrote to memory of 3768	32	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc182b02c0496f829ce9850c724ffbdf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:32
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc182b02c0496f829ce9850c724ffbdf.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:3684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads