87ea69570136c63736d95fd3950e11c67fd37ab1053410bc9e4aca66805a4cd9 | Triage

Analysis

max time kernel
148s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-03-2024 01:23

Sharing

Report Analysis Logs

General

Target

Geode.dll
Size

6.8MB
MD5

7502d8873ce70ddd59e348c29183ed85
SHA1

ac5df33b02c299b3880e4d71cde8f5b21361c3a7
SHA256

67ba23a77ab8cdbb240775185394263e2a0c4b0fe88d9dad9f3837ca6c382c39
SHA512

dd18cc1bd423c73dffbff8126c3a1b24bc882ac9b34fa275128a9ba4fecb22014efbe6c0998268b638bd0ed3928377faef426bce25815042d37659318e6091bc
SSDEEP

49152:K+RiFPY39QoGR/HUYD+eXoKWwvlKg5RYfqBrSQ0FXrs8VOW:vR3NGR/0GX3vlKfql0Vrs8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 740 wrote to memory of 3180	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 3180	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 3180	740	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Geode.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:740

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Geode.dll,#1
2⤵
PID:3180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4152 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:1036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads