622f15c89f1c0afaeacdf9672926967820a71c8ef1dbb3e39b28bbb9f238e0b5 | Triage

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 22:04

Sharing

Report Analysis Logs

General

Target

622f15c89f1c0afaeacdf9672926967820a71c8ef1dbb3e39b28bbb9f238e0b5.dll
Size

3KB
MD5

7be580defb0770da72458a0544047bd1
SHA1

0b4d603e373604547c49c799463a840998570cd0
SHA256

622f15c89f1c0afaeacdf9672926967820a71c8ef1dbb3e39b28bbb9f238e0b5
SHA512

be64671d2203a301646f3633e68b45c7efd7837810f9a9bf9b2a9a0f1f83d5886b0d2a17ba07f198ac9106df5d6b9a7803c94340b5b4b963d1cca0462aa3f97d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 2356	744	rundll32.exe	90
PID 744 wrote to memory of 2356	744	rundll32.exe	90
PID 744 wrote to memory of 2356	744	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\622f15c89f1c0afaeacdf9672926967820a71c8ef1dbb3e39b28bbb9f238e0b5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\622f15c89f1c0afaeacdf9672926967820a71c8ef1dbb3e39b28bbb9f238e0b5.dll,#1
  2⤵
  PID:2356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1288,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:8
1⤵
PID:4808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads