2d4f134af9291beecebc4d434948e15e5442ba3b5e3b27af0eb064754bc89308 | Triage

Analysis

max time kernel
152s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 19:27

Sharing

Report Analysis Logs

General

Target

c6af4825563aed7396ce6e625ba102ca.dll
Size

44KB
MD5

c6af4825563aed7396ce6e625ba102ca
SHA1

ea80425427b99bf3634d4ae4011e8307b6e6c75a
SHA256

2d4f134af9291beecebc4d434948e15e5442ba3b5e3b27af0eb064754bc89308
SHA512

18d8f116642b7b70ce36d7d1c6ef11d5d64f0f4a8715d3143e0a0ec7c488986de5cdeece6010634b35b427a69d81d3f53c5bec1c8269c36f10ed07a5b7265001
SSDEEP

768:ihJ2LY2wlig06TYtoslXskYgxe4R/eGY+kwb5JE:ukwMgXCoUXFYh4R/Eyb5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 696 wrote to memory of 2384	696	rundll32.exe	96
PID 696 wrote to memory of 2384	696	rundll32.exe	96
PID 696 wrote to memory of 2384	696	rundll32.exe	96

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6af4825563aed7396ce6e625ba102ca.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6af4825563aed7396ce6e625ba102ca.dll,#1
  2⤵
  PID:2384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2384 -ip 2384
1⤵
PID:2868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4116 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:2432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2384-0-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download