8714eb339bc30388fc3a0fe30d975e68d1e06cd9de4a513359a430000ea572c7 | Triage

Analysis

max time kernel
114s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 23:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ae24dbd2a6accf87c6969d3b82ba5682.dll
Size

6KB
MD5

ae24dbd2a6accf87c6969d3b82ba5682
SHA1

dd73da38f04f1b94169001931ef4d5a5b07f1ed7
SHA256

8714eb339bc30388fc3a0fe30d975e68d1e06cd9de4a513359a430000ea572c7
SHA512

8bc91b0a2bb1e201788bf8614847cb2ad0edf8633ff53dbe1fde86dda15d57e11c32ac43702eaf13fac167f348a4b4456abacc1af2c12f24713ba43f6b3aa53a
SSDEEP

48:6WQV5YVOqtV0H1pw9ygYVUG0dZB+BDq9J5SC:8qtV0HAr4SB+FqX5SC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2112	1664	rundll32.exe	91
PID 1664 wrote to memory of 2112	1664	rundll32.exe	91
PID 1664 wrote to memory of 2112	1664	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae24dbd2a6accf87c6969d3b82ba5682.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae24dbd2a6accf87c6969d3b82ba5682.dll,#1
  2⤵
  PID:2112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4340 --field-trial-handle=2240,i,16875000905773190493,11379096115878622792,262144 --variations-seed-version /prefetch:8
1⤵
PID:3580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads