8ee15f871bbb300d5507431734e4d71952a2ea74dd68ff3daac6a49579546e41 | Triage

Analysis

max time kernel
151s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/03/2024, 11:06

Sharing

Report Analysis Logs

General

Target

d359879142a453f7a72cae321428a462.dll
Size

69KB
MD5

d359879142a453f7a72cae321428a462
SHA1

94fa29fb0939b26d1a7e70b095798db16fc0e695
SHA256

8ee15f871bbb300d5507431734e4d71952a2ea74dd68ff3daac6a49579546e41
SHA512

beb42ac8b6aaa779b2a1b672742f9f1d252922b74179715d3d02e3aa64e1213bfeaecdddfb8dc1ba194d546e76efbf61cba4ce3d55998accc609668d114de4c3
SSDEEP

1536:E+PrTlpsup7LOpRvZ2RB+PrTlpsup7LOpRvZ2RY:EA5QFkLA5QFky

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 1460	2340	rundll32.exe	95
PID 2340 wrote to memory of 1460	2340	rundll32.exe	95
PID 2340 wrote to memory of 1460	2340	rundll32.exe	95

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d359879142a453f7a72cae321428a462.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d359879142a453f7a72cae321428a462.dll,#1
  2⤵
  PID:1460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
1⤵
PID:2224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads