9a33ff3deea984165327d7334e3cffa8df23aebcc1d1c0aa144044a52df35421 | Triage

Analysis

max time kernel
145s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 09:52

Sharing

Report Analysis Logs

General

Target

appdata/plugins/weather/main.dll
Size

46KB
MD5

f8778f223c6676966b3c32850875fa08
SHA1

34bc813fd1ce85dcca704ab25560ae6fe330abf0
SHA256

b188663b86b3e8d6d7d7d133c401dde46912c8c25f40e6268cdcad539f469a50
SHA512

9063bf41adbf49f286e5f89ae581f6cd050fae3e6cc4e37d89437f5b7ad141a5ac27c887392abbc68b32f6f489ab3a52fddff41c20bd05180bcfe26c93036b74
SSDEEP

768:lo5Bffw4vesPm/cGilW8ZmV0V8X01ufooF+6JLD:kpKT/6W8ZmynIJLD

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 1620	1536	rundll32.exe	97
PID 1536 wrote to memory of 1620	1536	rundll32.exe	97
PID 1536 wrote to memory of 1620	1536	rundll32.exe	97

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\appdata\plugins\weather\main.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\appdata\plugins\weather\main.dll,#1
  2⤵
  PID:1620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3208 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads