1f322c27dd109517cd7abe1add050a0d5ae84fc7ebb332e2a6de5b86d24a55f5 | Triage

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 16:38

Sharing

Report Analysis Logs

General

Target

c65db2a7f5597079e2df35ffef2abc9d.dll
Size

8KB
MD5

c65db2a7f5597079e2df35ffef2abc9d
SHA1

ca98a9e7d0f059c95303e5d7b858a7f29e3157ae
SHA256

1f322c27dd109517cd7abe1add050a0d5ae84fc7ebb332e2a6de5b86d24a55f5
SHA512

e21a06d5de90ba07478020b6ef694f9532bd8e099d819f0018ad00cf8b789fe7920b08e0b3b208438c74fc0aa9a9f00d092c155e4a5b0785f6fa8bd31f10b217
SSDEEP

192:Q8AqV1mdltIpLT4jW+zzvncXcPTuWClnY1BVkgUw9te:Q87IIpTkWvXcV8nY1B6L

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 1996	4532	rundll32.exe	89
PID 4532 wrote to memory of 1996	4532	rundll32.exe	89
PID 4532 wrote to memory of 1996	4532	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c65db2a7f5597079e2df35ffef2abc9d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c65db2a7f5597079e2df35ffef2abc9d.dll,#1
  2⤵
  PID:1996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1032 --field-trial-handle=2700,i,14629483171127516024,12350888228055326066,262144 --variations-seed-version /prefetch:8
1⤵
PID:4404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1996-0-0x0000000025000000-0x0000000025016000-memory.dmp

Filesize
88KB

Download