750c447d6e3c7d74ccab736a0082ef437b1cd2000d761d3aff2b73227457b29c | Triage

Analysis

max time kernel
166s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 11:54

Sharing

Report Analysis Logs

General

Target

xmlparse.dll
Size

52KB
MD5

4bf2029bbeda32417ed67f7b4cd924d2
SHA1

507cc7823ecbbe1734d4cad0a760b021c80512b0
SHA256

9a111643f7241d818a313fd8657f519dcff63a4235f5baa5a015abc65cb5073f
SHA512

ef190e5dada4dfd2fd1a9e78bed8dca3222da1083258e4f428867e62ca39d7a42ee4fce2142304be45c4c5a093f24e4a11b7c64fb78e10017c88e1101afb2bad
SSDEEP

768:Bqh2pNq38vL5VCdLOA89r7hSciQpEmqLr5BNMxvceJo93zp:zpg381V2Ox9rFScidLrNMxTo

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3752 wrote to memory of 216	3752	rundll32.exe	91
PID 3752 wrote to memory of 216	3752	rundll32.exe	91
PID 3752 wrote to memory of 216	3752	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\xmlparse.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\xmlparse.dll,#1
  2⤵
  PID:216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2256,i,9172343514068348080,519219714517961765,262144 --variations-seed-version /prefetch:8
1⤵
PID:1484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads