Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 02:19
Static task
static1
Behavioral task
behavioral1
Sample
7663f0650a510869a9c98ea30fec726e845f79e70ae2923487f1e77e70b62f7a.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
7663f0650a510869a9c98ea30fec726e845f79e70ae2923487f1e77e70b62f7a.dll
Resource
win10v2004-20240226-en
General
-
Target
7663f0650a510869a9c98ea30fec726e845f79e70ae2923487f1e77e70b62f7a.dll
-
Size
6KB
-
MD5
e4e1aad4fc26839c6ec990148e46a320
-
SHA1
db91dd7fda229db574ebdc032d5d9a12910088fd
-
SHA256
7663f0650a510869a9c98ea30fec726e845f79e70ae2923487f1e77e70b62f7a
-
SHA512
1b2c7e40c3a56420c4a3f5b407f2594730292f9df4c94fbc46b9678976539d06f6fe6c05ed1228e291c20d5f1a6b13807e9bb8865115a951596240494d5991d1
-
SSDEEP
48:6AA35YVOQDV8FszwydlAYsLFV3G0edB+BDq9J5S2:0QDV8FscMjsLFV3GdB+FqX5S2
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4140 wrote to memory of 4656 4140 rundll32.exe rundll32.exe PID 4140 wrote to memory of 4656 4140 rundll32.exe rundll32.exe PID 4140 wrote to memory of 4656 4140 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7663f0650a510869a9c98ea30fec726e845f79e70ae2923487f1e77e70b62f7a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7663f0650a510869a9c98ea30fec726e845f79e70ae2923487f1e77e70b62f7a.dll,#12⤵PID:4656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:81⤵PID:2312