0839139b6c0d3ce6df2d85873bf2a39dcd66f38d911645d51ebbfc84a0c0c29a | Triage

Analysis

max time kernel
153s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 23:06

Sharing

Report Analysis Logs

General

Target

109CommandLib.dll
Size

523KB
MD5

d05be9e2ed17e21d8ec2a60e9da711cd
SHA1

feff478392b221cd4994b94f6276d06c6b91bb55
SHA256

ec74fde19a73e9eabb64e389d9a9f608569906f0f1a4a644902ab6d19812ddff
SHA512

6bea1f89e500d4dcc8f984dc489b77a03a835e2c0d79f06f8a7e7be89977d89713b271be483f0eabe961fcd6bcd29cb99ea6dd7dfbb78f9e076ccb2cb09e0384
SSDEEP

6144:m+l7w3PcfTblC27/NMbzskCjNuHpCrsosfesNvxse32uLOQ:m+l7kcfPsIuyjNDrsosfDLsk2u

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 916	2312	rundll32.exe	95
PID 2312 wrote to memory of 916	2312	rundll32.exe	95
PID 2312 wrote to memory of 916	2312	rundll32.exe	95

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\109CommandLib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\109CommandLib.dll,#1
  2⤵
  PID:916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4888 --field-trial-handle=3084,i,14217130992253490921,11543335378077656547,262144 --variations-seed-version /prefetch:8
1⤵
PID:3164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/916-0-0x00000000756D0000-0x0000000075787000-memory.dmp

Filesize
732KB

Download