c9025f4e07447f8655a994c8c477266baff693c7f11cc1dc85292c333b4a83da

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 05:18

Target

ֽ/ByteDance-ʶֲ.word.exe
Size

245KB
MD5

4acc218e13667ca101cab9db29e44a77
SHA1

a84bcee7738b86ae41baee4e73d0a8c2a735e0fe
SHA256

1ab5183a4d362a358b27a66b3013fcb17486e3d44b018fc1fa2cc2c7ba3f963e
SHA512

361eaad250755271d5158c30393e28cdceed54d8756c13a22dde303147ae9a4530c3f9758628d69e43240bc5582056eabf3df6d3672f1dd3f51c109566aec89a
SSDEEP

6144:KpfXnqiLZ32RnqlPy0GrN5HTohi9qQuFnwOEm:KpfXnzGRnRrzoY9zOEm

Score

9^/10

oss_ak

detect oss ak 3 IoCs

oss ak information detected.

Processes:

resource	yara_rule
behavioral2/memory/392-24-0x0000000056D60000-0x000000005822B000-memory.dmp	detect_ak_stuff
behavioral2/memory/392-35-0x0000000056D60000-0x000000005822B000-memory.dmp	detect_ak_stuff
behavioral2/memory/392-41-0x0000000056D60000-0x000000005822B000-memory.dmp	detect_ak_stuff

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

ByteDance-ʶֲ.word.exe

description	pid	process	target process
PID 392 wrote to memory of 3048	392	ByteDance-ʶֲ.word.exe	cmd.exe
PID 392 wrote to memory of 3048	392	ByteDance-ʶֲ.word.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\ֽ\ByteDance-ʶֲ.word.exe
"C:\Users\Admin\AppData\Local\Temp\ֽ\ByteDance-ʶֲ.word.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5256 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:1252

memory/392-0-0x00000160F28C0000-0x00000160F2AAD000-memory.dmp

Filesize
1.9MB

Download
memory/392-19-0x0000000000400000-0x00000000005ED000-memory.dmp

Filesize
1.9MB

Download
memory/392-18-0x00000160F28C0000-0x00000160F2AAD000-memory.dmp

Filesize
1.9MB

Download
memory/392-2-0x0000000000400000-0x00000000005ED000-memory.dmp

Filesize
1.9MB

Download
memory/392-20-0x000001615D0C0000-0x000001615D118000-memory.dmp

Filesize
352KB

Download
memory/392-22-0x000001615EB40000-0x000001615EB98000-memory.dmp

Filesize
352KB

Download
memory/392-21-0x000001615D070000-0x000001615D0BC000-memory.dmp

Filesize
304KB

Download
memory/392-23-0x000001615CFE0000-0x000001615D02C000-memory.dmp

Filesize
304KB

Download
memory/392-24-0x0000000056D60000-0x000000005822B000-memory.dmp

Filesize
20.8MB

Download
memory/392-26-0x00000160F28C0000-0x00000160F2AAD000-memory.dmp

Filesize
1.9MB

Download
memory/392-27-0x0000000000400000-0x00000000005ED000-memory.dmp

Filesize
1.9MB

Download
memory/392-28-0x000001615D070000-0x000001615D0BC000-memory.dmp

Filesize
304KB

Download
memory/392-33-0x000001615D0A0000-0x000001615D0A2000-memory.dmp

Filesize
8KB

Download
memory/392-34-0x000001615D0B0000-0x000001615D0B2000-memory.dmp

Filesize
8KB

Download
memory/392-35-0x0000000056D60000-0x000000005822B000-memory.dmp

Filesize
20.8MB

Download
memory/392-41-0x0000000056D60000-0x000000005822B000-memory.dmp

Filesize
20.8MB

Download