0f95960120449aeba54a96103c366bfa8d922bc2fe72cbe0ff3565ec3ae03d42 | Triage

Analysis

max time kernel
124s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 12:16

Sharing

Report Analysis Logs

General

Target

Skybound.Gecko.dll
Size

176KB
MD5

9474404c6f530a5ee95367711061accc
SHA1

f7b16468728769708e4c45380ccfb0d8414ac679
SHA256

b1330c83e87c3a7514f3fba3a210d52e7362b9647317fb15b019394cee17a0e9
SHA512

165a8009c63486b7932a137dc9e6ae512676be53664317ca6f42204a24cac35a5c3e9f4c33a06a794d1d13a98259be85f47fdc2c666081022d2f7daf685d6444
SSDEEP

3072:w7+K1snsssliZGrdpYovc2PNMY0LJMDV:w7+KanHsU2nQK

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 3596	2772	rundll32.exe	91
PID 2772 wrote to memory of 3596	2772	rundll32.exe	91
PID 2772 wrote to memory of 3596	2772	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Skybound.Gecko.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Skybound.Gecko.dll,#1
  2⤵
  PID:3596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4120,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:8
1⤵
PID:1236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads