71131ba4a5d1b1c03d1afe8f52d2d2eac3c9639cf3eb9fb287034cab6ea0ec2d | Triage

Analysis

max time kernel
141s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 21:08

Sharing

Report Analysis Logs

General

Target

71131ba4a5d1b1c03d1afe8f52d2d2eac3c9639cf3eb9fb287034cab6ea0ec2d.dll
Size

3KB
MD5

709a18123b6c67c905b758dfdb20d6d8
SHA1

cd00ac974af0f24c61962830eed9c28ea4bea1ec
SHA256

71131ba4a5d1b1c03d1afe8f52d2d2eac3c9639cf3eb9fb287034cab6ea0ec2d
SHA512

b7ad00b01e5457c71b005dac5ad5aa9446fbcef301e46bb7048efff4aacccf04535bfbe0671fd33a2466cc611583561906b3d1bc153decb6a024a935d7cdf1af

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 4436	2560	rundll32.exe	96
PID 2560 wrote to memory of 4436	2560	rundll32.exe	96
PID 2560 wrote to memory of 4436	2560	rundll32.exe	96

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\71131ba4a5d1b1c03d1afe8f52d2d2eac3c9639cf3eb9fb287034cab6ea0ec2d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\71131ba4a5d1b1c03d1afe8f52d2d2eac3c9639cf3eb9fb287034cab6ea0ec2d.dll,#1
  2⤵
  PID:4436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3708 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:2252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads