e0ab6ef803903b6866fb2dcddf7352e06fedc088a2b8314f7829cc9f83f2a22e | Triage

Analysis

max time kernel
140s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ActiveBand.dll
Size

45KB
MD5

c36a5f6b5582d5fd6c9c19c1bc6b8b1d
SHA1

77ac565efff47b2d8995598f01e119627c144661
SHA256

c6d35a6d689d92cffc29f71a9472fb7244982a6f4ccc4e51d4aca1441045ae17
SHA512

3f35960cd3076021366f3c195269a5a2c0400b0fbce48402d96a68ce240d24752df1537809bea4220c30580ba26be5cb78d8ce741a7823a4923d23dba5b405ab
SSDEEP

768:qrG8rd9MSG/Z+xunR4BkE4KmMgUI8B1pdxlZquS2aebx/+JYBIB1sh3EJ:oG8rjjG/Z+xuR434JoY+hU

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3292 wrote to memory of 4024	3292	rundll32.exe	89
PID 3292 wrote to memory of 4024	3292	rundll32.exe	89
PID 3292 wrote to memory of 4024	3292	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ActiveBand.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ActiveBand.dll,#1
  2⤵
  PID:4024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5128 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:4860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads