27694908dbdcf9b68fe26c65140c22da7068c2ebd154db13d2eb1571f9153ede | Triage

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 21:15

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/ThreeCheckBoxListDll.dll
Size

181KB
MD5

8f916605c3a55e511b9e2aa3553074e2
SHA1

715e57cfc48fe7e195629b392153652346deb347
SHA256

1dd6be228b2d093b6c2d140be783fe3707760518a42ddd624da0fd7f3e206073
SHA512

c6daf882b9a160c3aa08261c9a7c8ace45e592bf33adc97f4ba41274c6d3aa56635ccc8e9f773befb3dcc6523a7eccb589da9195178102a52e7d809eb5bef963
SSDEEP

3072:XXUQ3ZVOfbjAaVhU7d5pDNN5IrKSNJlFmLqJIffM/GWxH+:NbOf3AaHqPw2O+

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 5068	1440	rundll32.exe	90
PID 1440 wrote to memory of 5068	1440	rundll32.exe	90
PID 1440 wrote to memory of 5068	1440	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ThreeCheckBoxListDll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ThreeCheckBoxListDll.dll,#1
  2⤵
  PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3236,i,16488180140590516186,11762960689811837350,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
1⤵
PID:1716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads