360f8e669f59d7484dc6019b4fdb9b39f33dbb3e95dec06fe8aed1f846f4a9d0 | Triage

Analysis

max time kernel
138s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 19:24

Sharing

Report Analysis Logs

General

Target

382d31dbf4631ea3f1e668016d930425.dll
Size

6KB
MD5

382d31dbf4631ea3f1e668016d930425
SHA1

56235832b1a5dc8603c9c37fa55a18135adbc142
SHA256

360f8e669f59d7484dc6019b4fdb9b39f33dbb3e95dec06fe8aed1f846f4a9d0
SHA512

ebc8129cc92e621216363f1a5bcf455728c85fa9253adc6a6083f8c31b56dca5888b1ed6288f131d093798337eb2ab850dbbe864c626ba9eb78e60801356b0e1
SSDEEP

96:hy859x0P8MaXRRj766tOcC91+10UNffs11Np:F5oL+76IgI/ffe

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 4076	4540	rundll32.exe	93
PID 4540 wrote to memory of 4076	4540	rundll32.exe	93
PID 4540 wrote to memory of 4076	4540	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\382d31dbf4631ea3f1e668016d930425.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\382d31dbf4631ea3f1e668016d930425.dll,#1
  2⤵
  PID:4076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4048 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:1752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads