284a18ed393b0e60ca6fada933c6612df9862d024038c51a0ab8906ccbdcc990 | Triage

Analysis

max time kernel
138s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 07:47

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/TXUninstallPlugin.dll
Size

1.1MB
MD5

28cd534fcf9d006e62cb26fc9056bc16
SHA1

500ee789ff2088fefd456c9ac8506376359a58a0
SHA256

fdd318b6b0954ce3183f6c6de90ac7a95273ac292adca12762c9a447eab34149
SHA512

19d3089f0dd3f9e6893667c61a800a6c043f90633461db6a51b3a9e2e4d410de9348e3a6ca51fd1b7df9201f36d863d4501bc0e177143c0c0e8e95b29ff45eff
SSDEEP

24576:S9c8TavrtuJwnXVIxSj2vxeXJR0tkBUks3mv:S+Dtu+VYSj2ZelsWv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 416 wrote to memory of 4824	416	rundll32.exe	90
PID 416 wrote to memory of 4824	416	rundll32.exe	90
PID 416 wrote to memory of 4824	416	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\TXUninstallPlugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\TXUninstallPlugin.dll,#1
  2⤵
  PID:4824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1032 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:3392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4824-0-0x00000000755D0000-0x0000000075755000-memory.dmp

Filesize
1.5MB

Download