90eb14763a17e64fe26e5cb8ce0df06c6b2fec782efd76351005455d6f6def67 | Triage

Analysis

max time kernel
152s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 07:36

Sharing

Report Analysis Logs

General

Target

c810aba338ef4a3dcc43bfff2246e6aa.dll
Size

3KB
MD5

c810aba338ef4a3dcc43bfff2246e6aa
SHA1

5ff7e749e0b0b857a3ae4e9bf0738d4e5cb0118f
SHA256

90eb14763a17e64fe26e5cb8ce0df06c6b2fec782efd76351005455d6f6def67
SHA512

77d24133547bd72930b78f0911a72df172e3a464f4f83b96dfec1d215032de83506080410819718e5deed1387cf051401a7d1b22c358505c9000efe807afe5ab

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 4864	4604	rundll32.exe	95
PID 4604 wrote to memory of 4864	4604	rundll32.exe	95
PID 4604 wrote to memory of 4864	4604	rundll32.exe	95

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c810aba338ef4a3dcc43bfff2246e6aa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c810aba338ef4a3dcc43bfff2246e6aa.dll,#1
  2⤵
  PID:4864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4124 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:4276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads