1ec79bc060be456223b006db754341d6e5996782c4dbfc8e76538b22e544a07f | Triage

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 10:17

Sharing

Report Analysis Logs

General

Target

cb26e1851da714fcf9a8293823b924c6.dll
Size

60KB
MD5

cb26e1851da714fcf9a8293823b924c6
SHA1

64836063b25dcceb1f3bc114a844ebe678527144
SHA256

1ec79bc060be456223b006db754341d6e5996782c4dbfc8e76538b22e544a07f
SHA512

a91003f97f8872563db24bd6c6d813b6115e066d41f99bd48ba2d222b05dc41e5613b1ba5fee4a8dc4bec1d91adb9a754ae1a55a071cbbb3df21a9c89007c664
SSDEEP

1536:iNqwLyQkjJLTA1kB7S8lKoG0M4Ppn8Npnu2x:4+J58kBvKpH4i5ug

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 836	4016	rundll32.exe	97
PID 4016 wrote to memory of 836	4016	rundll32.exe	97
PID 4016 wrote to memory of 836	4016	rundll32.exe	97

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb26e1851da714fcf9a8293823b924c6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb26e1851da714fcf9a8293823b924c6.dll,#1
  2⤵
  PID:836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:5084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads