97f316b567be836f302b4182037f02e17e2a8272534ce830a3d1d2ea15237006 | Triage

Analysis

max time kernel
158s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 10:52

Sharing

Report Analysis Logs

General

Target

AsyncTask.dll
Size

111KB
MD5

3ae8f78d7c06b0241e6c11d5c005e773
SHA1

c5337030e7e6c0356dbf51b53098d855f258bf95
SHA256

b1b6771567ec1f860cd7eedacb3e5b3d7b3c1b97a05398388fd7ff0b9e7cf2ff
SHA512

b8cb3a1e4cae1407418526cefd4eb2b8e7e26c4ea225b4ba69d2be9cbddd5c97cf9c769ffc6597a266fba15d931681bcfb62b09b8bb5fdc5311755bf0e115e70
SSDEEP

1536:qxcNC1tesY0vCUcWX0qaRpPODktoBdGyAIdBsKAMW65Q:33acWX0D7PODktoBdGyAIdBsKAMx5Q

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3324 4748 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3124 wrote to memory of 4748	3124	rundll32.exe	rundll32.exe
PID 3124 wrote to memory of 4748	3124	rundll32.exe	rundll32.exe
PID 3124 wrote to memory of 4748	3124	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AsyncTask.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3124

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AsyncTask.dll,#1
2⤵
PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 620
3⤵
- Program crash
PID:3324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4748 -ip 4748
1⤵
PID:4936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1400 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...