fcfcea85a15e4cfeb120fb025974a9c3c115bba77f1ed860782861bec4e0b926 | Triage

Analysis

max time kernel
141s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03-04-2024 19:38

Sharing

Report Analysis Logs

General

Target

DataMaster.Providers.CrsData.dll
Size

31KB
MD5

117e9b7beba02ea85b0e226339a16da3
SHA1

d3c1961cef29e0e83e39bcfe8f1143cd77832706
SHA256

662038d8bea914df39196d0aca3fec3f7ec87392161f215625e08f47e7cadaa5
SHA512

2a1950fc6e6114e90e151a82f37480ac4f207e1730937dabf448d1a4a02952617ccaa511c3a8dc2fc301e4aedd2dfd8783b5c5a22fef432de1ca2385a2f1bf0f
SSDEEP

768:yYVggc0nv8C4XPL3CEkerFHiVacVqrVwrFy:yYVTcgv8C4XAeuJy

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1668 wrote to memory of 2184	1668	rundll32.exe	rundll32.exe
PID 1668 wrote to memory of 2184	1668	rundll32.exe	rundll32.exe
PID 1668 wrote to memory of 2184	1668	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DataMaster.Providers.CrsData.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1668

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DataMaster.Providers.CrsData.dll,#1
2⤵
PID:2184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:3096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...