95bc091c9ae9dce5f3bdc4bd19c913f8d0036f28b2ad49425f410dbb81f8b568 | Triage

Analysis

max time kernel
138s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 22:06

Sharing

Report Analysis Logs

General

Target

342eafd8b52a409e2f432b3b8349fd88.dll
Size

6KB
MD5

342eafd8b52a409e2f432b3b8349fd88
SHA1

cb2bb654e4df16b06ff60deeda4827ac54f82fab
SHA256

95bc091c9ae9dce5f3bdc4bd19c913f8d0036f28b2ad49425f410dbb81f8b568
SHA512

d1ffe15d60e5a4d5d6be93f6b996860ee34d27fca784afef0a472aa15ade4cb23d52c97c4088bb61c61fafddd06eae9d688034fda3d518bff7e9ab438417db7e
SSDEEP

48:63mll5YVOa9VUX1iwbQWu0mB+BDq9J5SH:VDa9VUX9bQWGB+FqX5SH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2916	2596	rundll32.exe	92
PID 2596 wrote to memory of 2916	2596	rundll32.exe	92
PID 2596 wrote to memory of 2916	2596	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\342eafd8b52a409e2f432b3b8349fd88.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\342eafd8b52a409e2f432b3b8349fd88.dll,#1
  2⤵
  PID:2916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:1864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads