a096845d6c5f7ca8a131768cbe86b57fb70c39612110ad819617117e9b08a1ae | Triage

Analysis

max time kernel
139s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2024 00:17

Sharing

Report Analysis Logs

General

Target

System.ComponentModel.dll
Size

30KB
MD5

6972a286b196cea3b21c77a37c0cd329
SHA1

bf3e9081156f9518ac46b692f55edd5e70147b6f
SHA256

0d2cd39b276ecb4072873ff5227e6e510ef130b1113acb0eb1bf46b275c0b513
SHA512

81abb2c0cbdbd06ab21adfff126d8356221db892d04dcd7d09c5052cf1199bee9e652625c7e91700b0f918cd57031476a35de8d78b1332aceb6c0fa2416d8944
SSDEEP

384:pW4X1WCnTySJXgb+MH8AAB5kHRN7LR9z3BTsT2:FYLRd9z3Bm2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 3228	3988	rundll32.exe	96
PID 3988 wrote to memory of 3228	3988	rundll32.exe	96
PID 3988 wrote to memory of 3228	3988	rundll32.exe	96

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.ComponentModel.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.ComponentModel.dll,#1
  2⤵
  PID:3228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3984 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:4256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads