0dc7dc260c73a1c6de6082f67ca2bf8ac9c5f267876306b9c9eb7d8f1f502ed8 | Triage

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 22:41

Sharing

Report Analysis Logs

General

Target

c1c9d5d930a35cdc4b6b26ee124510c5.dll
Size

17KB
MD5

c1c9d5d930a35cdc4b6b26ee124510c5
SHA1

f7ea82c0a660e3ef33d536e62a0fc707df30220b
SHA256

0dc7dc260c73a1c6de6082f67ca2bf8ac9c5f267876306b9c9eb7d8f1f502ed8
SHA512

db15e842a37cc3fe2776579bc86a37135b4d7c3494ce22fa517b91e90fe805177169963ffc50e43ce59fc46c7f3f7d721fb7453f154aa47ea74c50706c0cb87e
SSDEEP

384:6FveO0HneGQ/asfk1en8LHgFBDGqGpBkT:k/0Hne/sc8LWBDG6T

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 4488	3932	rundll32.exe	94
PID 3932 wrote to memory of 4488	3932	rundll32.exe	94
PID 3932 wrote to memory of 4488	3932	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1c9d5d930a35cdc4b6b26ee124510c5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1c9d5d930a35cdc4b6b26ee124510c5.dll,#1
  2⤵
  PID:4488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1420 --field-trial-handle=3136,i,3192284747741020952,1225278682167953346,262144 --variations-seed-version /prefetch:8
1⤵
PID:2292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4488-0-0x0000000010000000-0x000000001006C000-memory.dmp

Filesize
432KB

Download