808ccd81cbb014df3475fa04ffc0fae33470a6d2279052dce33349f208558100 | Triage

Analysis

max time kernel
141s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 03:24

Sharing

Report Analysis Logs

General

Target

ClientAPI.dll
Size

100KB
MD5

69d5c7d40edb86211e3f284a4e862a28
SHA1

d0ce76def9137d1b8408f1f36c559e64174bcffd
SHA256

6b66227709b04160a7563e8200fd05b698b343fa1334e9f2cb0f086cc4ef02ad
SHA512

254bf1af42111d49571419c641fbeb8ba7986fdedfdb998614cdf895d2a186b4f965f099e6949c41d2bc1cf7874098e4e42a7e3756595e03412267b9e2aaaab9
SSDEEP

1536:/XkY0qKCT2wfBFiMREP/+yowPD5PMyxo+jcao8VQ6GaCx:/mqHfBFLEPh1Bo+jLFmE

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4752	956	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 956	4888	rundll32.exe	91
PID 4888 wrote to memory of 956	4888	rundll32.exe	91
PID 4888 wrote to memory of 956	4888	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ClientAPI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ClientAPI.dll,#1
  2⤵
  PID:956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 624
    3⤵
    - Program crash
    PID:4752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 956 -ip 956
1⤵
PID:2520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:3400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads