Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
17/04/2024, 10:52
Static task
static1
Behavioral task
behavioral1
Sample
16130f475e857219c60105ea8b39ff2bfc391c182883e8ce0870357143b0faa9.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
16130f475e857219c60105ea8b39ff2bfc391c182883e8ce0870357143b0faa9.dll
Resource
win10v2004-20240226-en
General
-
Target
16130f475e857219c60105ea8b39ff2bfc391c182883e8ce0870357143b0faa9.dll
-
Size
4.6MB
-
MD5
c89d4aae9c6fa8f2beb6d047d21d3d86
-
SHA1
e840bc5f0eb2bd5143c541edc3d6af72bfa0c01e
-
SHA256
16130f475e857219c60105ea8b39ff2bfc391c182883e8ce0870357143b0faa9
-
SHA512
9ddd1ebb580a79f56b0c8946ac6a6f43ed6092b1836da49bfa1053f394c1573bdf29f8d5c221c610c9fc34128776f14d85b5129c398c34cc6b8039ba6053c112
-
SSDEEP
49152:F0YAaVo8oP3KpuZj3QcG2jGnYALzuNaeae7nHz79KFeMJ:63zv70Fe8
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\kdfgdfgdfhfed rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4744 rundll32.exe 4744 rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\16130f475e857219c60105ea8b39ff2bfc391c182883e8ce0870357143b0faa9.dll,#11⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4744
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1412 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:81⤵PID:2212
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33B
MD52ea5ebbfc702b501407f4809830e841c
SHA145304e4832f3f3016a64a09bd40e0d7bdb2846d7
SHA256889d9540eb9ce8a7c14199d988625aa22022a5c2b91ccf8a20caffda34910c36
SHA512925941c0c6a40b21ecb4954a6e4f3ab288f826f3df08acbe6d650ec95f4ad73ebffeaf45f35b82a729092f8cfa2ad14d2e88facbba5ff0dae709671d225ac5e9