72f102fc3d5af3ab0f247faa414fdda6d64280924ecc5717e07d74fa379235a0 | Triage

Analysis

max time kernel
139s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 06:10

Sharing

Report Analysis Logs

General

Target

fpdfsdk.dll
Size

2.8MB
MD5

53fdd251a06c831c3024fd4fa19b50e6
SHA1

4c7f08aba66cadac29931cb3a9674e8b9479c11d
SHA256

72f102fc3d5af3ab0f247faa414fdda6d64280924ecc5717e07d74fa379235a0
SHA512

c5093c90db5dd6c452851ed0f610eadcba5077e3d9bee09a3fbc872031efe59cac657d0035c337f6b5570cc35fb8508863d25ac1abe024a6c085733186996192
SSDEEP

49152:LIulRcUJtRNLNx4LaiPG+JEETg3QEfeoG:LIHMNLlAV

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 2336	3484	rundll32.exe	91
PID 3484 wrote to memory of 2336	3484	rundll32.exe	91
PID 3484 wrote to memory of 2336	3484	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fpdfsdk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fpdfsdk.dll,#1
  2⤵
  PID:2336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4276,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
1⤵
PID:880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads