4ea213f2be6157ff210a47102197c41f09bb809a3dab0601357bb2d7fe9edf1c | Triage

Analysis

max time kernel
139s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:41

Sharing

Report Analysis Logs

General

Target

4ea213f2be6157ff210a47102197c41f09bb809a3dab0601357bb2d7fe9edf1c.dll
Size

2KB
MD5

45ff562cc36aef4b51a712d65d29e8b0
SHA1

e78be818ceb7bf8941d6e9304579947a433b8428
SHA256

4ea213f2be6157ff210a47102197c41f09bb809a3dab0601357bb2d7fe9edf1c
SHA512

c41bba3f7cb50fb52636008f5008b3a53f751dd11fdf076a411fd24ab6e2390d76f95d5c1691ddc54dfa992de55948df87f712ed00d6437581f0762b2a5423e5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4616 wrote to memory of 1900	4616	rundll32.exe	rundll32.exe
PID 4616 wrote to memory of 1900	4616	rundll32.exe	rundll32.exe
PID 4616 wrote to memory of 1900	4616	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ea213f2be6157ff210a47102197c41f09bb809a3dab0601357bb2d7fe9edf1c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ea213f2be6157ff210a47102197c41f09bb809a3dab0601357bb2d7fe9edf1c.dll,#1
  2⤵
  PID:1900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1900 -ip 1900
1⤵
PID:912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4256 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1900-0-0x0000000002E00000-0x0000000002ED2000-memory.dmp

Filesize
840KB

Download
memory/1900-1-0x0000000002E00000-0x0000000002ED2000-memory.dmp

Filesize
840KB

Download