639b3bd6ef84cf876cd37b0724466ef155e579a5dc9d45c19fcf2611afa892e5 | Triage

Analysis

max time kernel
142s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 22:52

Sharing

Report Analysis Logs

General

Target

796abbb12cb16b4bae383817ca16cd41.dll
Size

6KB
MD5

796abbb12cb16b4bae383817ca16cd41
SHA1

7a1972cf2bebabefb82acce1cdf8a21ea81224c1
SHA256

639b3bd6ef84cf876cd37b0724466ef155e579a5dc9d45c19fcf2611afa892e5
SHA512

977eb1b5b1929fac6416588ac3056f0c9fd1848f9772d4f1292c8dcaee0707ca028aa677ef21c887fb59c5f556d312d3ca6ca0ee0e21c24aacebdb04bb0f9792
SSDEEP

48:6amN5YVOy1VEvy/dw25M+e0EB+BDq9J5SzXH:Wy1VEvayP+UB+FqX5SzX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 4196	1800	rundll32.exe	93
PID 1800 wrote to memory of 4196	1800	rundll32.exe	93
PID 1800 wrote to memory of 4196	1800	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\796abbb12cb16b4bae383817ca16cd41.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\796abbb12cb16b4bae383817ca16cd41.dll,#1
  2⤵
  PID:4196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4056 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:4884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads