e21d43f1fc12059ac755b1160a88afe7debff2e41dd6136a2e9c3f5175678bab | Triage

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 07:56

Sharing

Report Analysis Logs

General

Target

e12a738d0432b2cf41ac3dc82e6d64b0.dll
Size

10KB
MD5

e12a738d0432b2cf41ac3dc82e6d64b0
SHA1

b7a21dccec27eb7c29be3dfae38a92343de6150a
SHA256

e21d43f1fc12059ac755b1160a88afe7debff2e41dd6136a2e9c3f5175678bab
SHA512

9bdd1f3f2414d78341f77e297f50a0f0ea2b9d5aff2b07bad5e2050a4a3649b6ef73d97843a2f9d17a3b21b34b43a303572c7aeb02688d8e513c301b8b482de7
SSDEEP

192:p4r7TtEVeNUcnE5DdCj3msqFSGpfKFRjh9SEjP:p4rPtEynE5DAj3BqFf6jh9SkP

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4132	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 4132	400	rundll32.exe	94
PID 400 wrote to memory of 4132	400	rundll32.exe	94
PID 400 wrote to memory of 4132	400	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e12a738d0432b2cf41ac3dc82e6d64b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e12a738d0432b2cf41ac3dc82e6d64b0.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4040 --field-trial-handle=2288,i,10301911031503898037,2997280636231771547,262144 --variations-seed-version /prefetch:8
1⤵
PID:4240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads