025ca9a56a4ab20702dd386fef1d2df311646fb741841cc64d70d37f84468876 | Triage

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:31

Sharing

Report Analysis Logs

General

Target

DriverInstall/LiveUpd360.dll
Size

410KB
MD5

3e6a4fb17fc307a49f9cd1bd4dc838b5
SHA1

c35455fb190aee9b4eadc5aa999340767740d29a
SHA256

7494b01c952162aad24932db3cbbbf4ec8d81825ba5a33b0a0faebeb9b94f94e
SHA512

f7d88cae3ff889ac043581e9fa358ad764ba29903d35d90ff3e314bb11cf6e6be70cca9d8d0406437bbf954ea39beaf79e95f93dd27e3380506ab582e2187f2d
SSDEEP

12288:t4wESFsoRF1UWhYItXUk7GQiA74AfAFKaI6pv1JMzd2dc:p1Rn984AAaI4NJsd2q

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2388 wrote to memory of 764	2388	rundll32.exe	rundll32.exe
PID 2388 wrote to memory of 764	2388	rundll32.exe	rundll32.exe
PID 2388 wrote to memory of 764	2388	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DriverInstall\LiveUpd360.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2388

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DriverInstall\LiveUpd360.dll,#1
2⤵
PID:764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3784 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:5056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads