294a21491eb06b0970f4b0512ac9a194779372fa5e02c318fb7063353f3ec029 | Triage

Analysis

max time kernel
139s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 12:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

WD230cpl.dll
Size

1005KB
MD5

01d90bf03541a8c5106731d444aec3e0
SHA1

45e85549452961fbacf430a55f45ec9c6ec7a9ab
SHA256

294a21491eb06b0970f4b0512ac9a194779372fa5e02c318fb7063353f3ec029
SHA512

f7af94821f65700dd459bdcbae25689002601c7739a0d89c124140e63eb0a6ca8f04eb56e9c611b5aa542df65ef435b9aa6983732842b1c15f2e2898807b8761
SSDEEP

24576:YPCSnJ8X3QKIUfe3WfpfjA1kkPzORd4IR:jIApfZhAxOPR

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 744	2952	rundll32.exe	91
PID 2952 wrote to memory of 744	2952	rundll32.exe	91
PID 2952 wrote to memory of 744	2952	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WD230cpl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WD230cpl.dll,#1
  2⤵
  PID:744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4136,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:8
1⤵
PID:5008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads