e723ee615d7a64e918ab185b645324a0cb1b376302d33b54995b54da39be51f3 | Triage

Analysis

max time kernel
140s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19-05-2024 20:31

Sharing

Report Analysis Logs

General

Target

SASHOOK.dll
Size

65KB
MD5

c278352103ee28bfbabd18254d15a430
SHA1

9db1e8176f02b9c83ba4a7ec69efad35b4d0e37b
SHA256

79b40a60711f5687d20afe695074a535397ed87ca42df2e47ea545f2c0ebc3bf
SHA512

df59ff1b1023edd4d4a40a83a80a5706de74c28f4b04b47a122f1d1335b57e81d0cabe4160246a5b3f5aa38788e248bd9c045c85e0c4477c5078cc3ff3142e4e
SSDEEP

1536:C465M/t+I4qiROQF2huU4VN1y891bXhOrs5SQAGkGzWoc:C4LwvROQF2Y/g8pOriSQ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3204 1296 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1796 wrote to memory of 1296	1796	rundll32.exe	rundll32.exe
PID 1796 wrote to memory of 1296	1796	rundll32.exe	rundll32.exe
PID 1796 wrote to memory of 1296	1796	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SASHOOK.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SASHOOK.dll,#1
  2⤵
  PID:1296
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 604
    3⤵
    - Program crash
    PID:3204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1296 -ip 1296
1⤵
PID:4436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3740,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:8
1⤵
PID:2908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1296-0-0x0000000000850000-0x0000000000868000-memory.dmp

Filesize
96KB

Download
memory/1296-1-0x0000000000850000-0x0000000000868000-memory.dmp

Filesize
96KB

Download