9b587f0574d013ada38f6973195e0ebcb1889952370dd3396e9f89e3622ff81a | Triage

Analysis

max time kernel
140s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-04-2024 01:43

Sharing

Report Analysis Logs

General

Target

LibSearchFileName.dll
Size

53KB
MD5

38bc4e2efb6e6391ca2d2e6d4af09592
SHA1

ebea8ddf0c85224880ad3e286c1856f09358e151
SHA256

10baf02d6695479b5975578e87d205ab676e9108d1d138ff0b6edd50a55cacc1
SHA512

bfeaa3daf949fbc9a528643aea1748e7fcadbc5efb140f0169da69203d65b3645a672ae6a515f04d0f0c54f09e0c386ccca6991fdc9553c0b18574b8016e80e1
SSDEEP

768:AttOSW6gvM3QYvPCyyWoXyDw3mF4Y2yEFQhx0S+3/A8PZc:ALOJwPSyBK2F4pOx+3/RBc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1136 wrote to memory of 1120	1136	rundll32.exe	rundll32.exe
PID 1136 wrote to memory of 1120	1136	rundll32.exe	rundll32.exe
PID 1136 wrote to memory of 1120	1136	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LibSearchFileName.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1136

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LibSearchFileName.dll,#1
2⤵
PID:1120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
1⤵
PID:4352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...