540068c80ffa28a769d386c8912c8ceaa0154c24b0c35d3c0df1885ef5c7762d | Triage

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 09:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c8423bae82b751d884c5a58ff3c31211.dll
Size

204KB
MD5

c8423bae82b751d884c5a58ff3c31211
SHA1

a539286e88be5c544e104c9ce80a0c7f609c98ff
SHA256

540068c80ffa28a769d386c8912c8ceaa0154c24b0c35d3c0df1885ef5c7762d
SHA512

96a7ffa4c7b1ff9df8f690552e0e85b7e505927b0048eda54d01af2e6ffe2b647e1f7944b964dfb1dc1ee26583eb5a44f6b36e3fe95c7c3cdeb30b4354cd25f7
SSDEEP

6144:EXYg7KiFGgQzsqZWpbpGRyuvGCIqqDLu:yG9s0v+CNqnu

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 3284	2868	rundll32.exe	93
PID 2868 wrote to memory of 3284	2868	rundll32.exe	93
PID 2868 wrote to memory of 3284	2868	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c8423bae82b751d884c5a58ff3c31211.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c8423bae82b751d884c5a58ff3c31211.dll,#1
  2⤵
  PID:3284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3824 --field-trial-handle=2432,i,12161922670941700748,3348345705955601576,262144 --variations-seed-version /prefetch:8
1⤵
PID:548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3284-1-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3284-0-0x0000000001210000-0x000000000121A000-memory.dmp

Filesize
40KB

Download