544f4a2054b25b2c81d6a07498b393192df6182547348477c33aa6adbe5598ab | Triage

Analysis

max time kernel
137s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 09:11

Sharing

Report Analysis Logs

General

Target

cdaac24adfe5717eab3957ce49a0e769.dll
Size

40KB
MD5

cdaac24adfe5717eab3957ce49a0e769
SHA1

8be92cd99ca71f9f45aa34f771286e93cb575cfb
SHA256

544f4a2054b25b2c81d6a07498b393192df6182547348477c33aa6adbe5598ab
SHA512

cd645108d201d0b17c5c8475a0f80bba777bbe4ebe929c9c83e46e97975e6b7e32f0145748e85ef39fac0b8e920d8d27f19ab8df57a84972856ae53957cef1ce
SSDEEP

768:h/S1B6NCNVIQX6DRuzArXCy4gIqkRie5orr:h61BqRugyy4gKW3

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1512	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 1512	3424	rundll32.exe	94
PID 3424 wrote to memory of 1512	3424	rundll32.exe	94
PID 3424 wrote to memory of 1512	3424	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cdaac24adfe5717eab3957ce49a0e769.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cdaac24adfe5717eab3957ce49a0e769.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4112 --field-trial-handle=2304,i,7548677271533893574,11048237606705436109,262144 --variations-seed-version /prefetch:8
1⤵
PID:448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads