909df004857e854a646328179d73a9738eec6b2eb559be3b0cd8d3c53b3dd29a | Triage

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 05:06

Sharing

Report Analysis Logs

General

Target

Dyn/DllJmpKiller.dll
Size

53KB
MD5

05ee82899ddfbc549699bbb50a654b47
SHA1

49e5a506bc42470d37ef4bddf7d69ed05571875a
SHA256

ea1d741a8ac90c4ec23a7836c3da06648485575457642f963cd2ebe57c5faf8e
SHA512

2e1d793787808ff8da49151dc37472af9d7538f1b30ff1431774dfbdc76596476f6eeed8bccf7d041ee74b04f950c6e126631f98360758fce942202525bbf260
SSDEEP

768:gJjWTJrhPcZ/WFpAdzCbzHs+FjhDl6Dzj/n4LZm:uWTJrBquQzCPHR7l6Dz7n44

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 1548	216	rundll32.exe	96
PID 216 wrote to memory of 1548	216	rundll32.exe	96
PID 216 wrote to memory of 1548	216	rundll32.exe	96

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dyn\DllJmpKiller.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dyn\DllJmpKiller.dll,#1
  2⤵
  PID:1548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4292 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:1180

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads