89e7621123c613d82aadfe6defded7f2816a7add36a7ef1576c08206c84fc90d

Analysis

max time kernel
114s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 16:34

Target

JoltBeacon.dll
Size

170KB
MD5

6a6c11510e1743835c938eb1135d5f8f
SHA1

cab05283c7458cb74499772525f1eeb174ae2daa
SHA256

89e7621123c613d82aadfe6defded7f2816a7add36a7ef1576c08206c84fc90d
SHA512

149c6f5bcf6b05c40e1c040d89586b6d992bbc7c3c23ca24292caa064531f373dee1243249f803fd20abfe53621ec7816d4fdb097cc2ee63bbca209cc993ccd5
SSDEEP

3072:WGDjIrSZFEhB2oMk3pXO+4ao8eB4JP5/xemoyUuziq7:WYj3KhWmODB4//xloyUuuq

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4780 set thread context of 3572	4780	rundll32.exe	98

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 3572	4780	rundll32.exe	98
PID 4780 wrote to memory of 3572	4780	rundll32.exe	98

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JoltBeacon.dll,#1
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Windows\System32\msiexec.exe
  \??\C:\Windows\System32\msiexec.exe
  2⤵
  PID:3572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2284,i,2771196087253062161,8107167670425198948,262144 --variations-seed-version /prefetch:8
1⤵
PID:4352

memory/3572-10-0x0000025B60CA0000-0x0000025B60CE0000-memory.dmp

Filesize
256KB

Download
memory/3572-12-0x0000025B60CA0000-0x0000025B60CE0000-memory.dmp

Filesize
256KB

Download
memory/3572-17-0x0000025B630E0000-0x0000025B632D5000-memory.dmp

Filesize
2.0MB

Download
memory/3572-28-0x0000025B60CA0000-0x0000025B60CE0000-memory.dmp

Filesize
256KB

Download
memory/4780-0-0x000001B1812F0000-0x000001B1814E5000-memory.dmp

Filesize
2.0MB

Download