7fc30b11b1b5b5ee8a2a774ed7bc5b2cb38d1c2a530939239e9f00bfb981c057 | Triage

Analysis

max time kernel
133s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 05:22

Sharing

Report Analysis Logs

General

Target

CloudExperienceHostUser.dll
Size

199KB
MD5

870d89c1263926ee8fb460000e933291
SHA1

601296f3ff6361f21d8d76134d1e74a8aee7652c
SHA256

7fc30b11b1b5b5ee8a2a774ed7bc5b2cb38d1c2a530939239e9f00bfb981c057
SHA512

1475e0ae34f8cc95af6d2f9ea00909f982e268b707099985975d6b9b8073a127cf760d2c83a3b3bd4132ad008c7dafe12ae1b5bef6752878ee29881bcdb9d200
SSDEEP

6144:27ZE7XAT6WhTezB9jQpIp7JzrrGom4Hb2Bx:2lEj5j52Bx

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1772	1948	rundll32.exe	83
PID 1948 wrote to memory of 1772	1948	rundll32.exe	83
PID 1948 wrote to memory of 1772	1948	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CloudExperienceHostUser.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CloudExperienceHostUser.dll,#1
  2⤵
  PID:1772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads