134c5d1acefee78416ad78742e402a3992bf3ab31ce21a7c3bf07cf4e182ef22 | Triage

Analysis

max time kernel
139s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 16:11

Sharing

Report Analysis Logs

General

Target

Modules/ArSp.dll
Size

38KB
MD5

c7147f4c8432b235801efcce5ce6cc4b
SHA1

0a212712de818ee6b6347a69788c628a1ad97a5f
SHA256

dd5b037412d20d8d316c1f1c937291275bb78394c47e97c1cc3c284e801ac9df
SHA512

1820fb4def4b075c991f97fb14bd8ad040ce78ca28eb418c5d2a45dd50ef98d8f73191b830388e8339b44f0daa7ef3e77b119c7efd09766fd935078a6274980a
SSDEEP

768:u/PidxjnQyslT/9wtRBYzNjMLwYFScciM:6PidtnPgr9wOzNoMYFS3iM

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 3240	4744	rundll32.exe	92
PID 4744 wrote to memory of 3240	4744	rundll32.exe	92
PID 4744 wrote to memory of 3240	4744	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\ArSp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\ArSp.dll,#1
  2⤵
  PID:3240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4040,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=1040 /prefetch:8
1⤵
PID:1548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads