0ecb58eff1dd7994f3af2aa57dafb3f86cc802c7cd152b9f19cdfe7e5aea9cc9 | Triage

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 12:19

Sharing

Report Analysis Logs

General

Target

bass.dll
Size

96KB
MD5

8741c1669550d89bc781dfa5ac11da8b
SHA1

d083e66010aa0f884ad80823384e7f50c3eaaf68
SHA256

91dabc42430075dd6b29a143a6cbed02e2135b3db9f76bd90ddd7621a13da54d
SHA512

e7d0a0bf6852eb9ec24bf1e9e7546276469e6445437e949507facfc22009e3dc82994d6e9ed9aaeff9fc90c89507f325e47344d22d00d04238205873ce24fb01
SSDEEP

1536:jYcrMnh/DhwDXL0vhRZ9KEsgAL6OeUko/wToQUe4E8Gf6cp5WDXLbfYEjr/9:s+Mh/dzZg5gfTgSoq4PGScpkLbh

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 3924	3704	rundll32.exe	93
PID 3704 wrote to memory of 3924	3704	rundll32.exe	93
PID 3704 wrote to memory of 3924	3704	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bass.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bass.dll,#1
  2⤵
  PID:3924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2260,i,9938964625802268469,1928462186077019554,262144 --variations-seed-version /prefetch:8
1⤵
PID:4068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3924-0-0x0000000011000000-0x0000000011062000-memory.dmp

Filesize
392KB

Download