Analysis
-
max time kernel
132s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 02:06
Static task
static1
Behavioral task
behavioral1
Sample
7431e66e7e7156f30001365e4dfcb43d89208b94b49bccd30d94830766ae7125.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7431e66e7e7156f30001365e4dfcb43d89208b94b49bccd30d94830766ae7125.dll
Resource
win10v2004-20240508-en
General
-
Target
7431e66e7e7156f30001365e4dfcb43d89208b94b49bccd30d94830766ae7125.dll
-
Size
148KB
-
MD5
5b56633724ba7e5b603a552059d47fa0
-
SHA1
d801808963dc5f1248f0f92a2224ba60d73af439
-
SHA256
7431e66e7e7156f30001365e4dfcb43d89208b94b49bccd30d94830766ae7125
-
SHA512
51fd480050efbb714f5b8fa6238eba299f67c31850541c851d0b3ec607a31f4e539bf369828e31efb725fad531e1bb3225c8b880257935ea4813d457ea2b74f9
-
SSDEEP
1536:F/8TxZpIEWmeXi8GI1sawxm9mL0ri560tHnsjC7f+s5:iBTWy8HeA9mLQiE0RnL
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4084 wrote to memory of 5060 4084 rundll32.exe rundll32.exe PID 4084 wrote to memory of 5060 4084 rundll32.exe rundll32.exe PID 4084 wrote to memory of 5060 4084 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7431e66e7e7156f30001365e4dfcb43d89208b94b49bccd30d94830766ae7125.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7431e66e7e7156f30001365e4dfcb43d89208b94b49bccd30d94830766ae7125.dll,#12⤵PID:5060
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3452,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:81⤵PID:1940