7065924119adab65e2694c4960292ef118592142666efff9df470037b7689c34 | Triage

Analysis

max time kernel
135s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 11:52

Sharing

Report Analysis Logs

General

Target

ICCard.dll
Size

1.6MB
MD5

9c0bdb70d190e39b14ebe79ecf3bf8d3
SHA1

53335d65c54cd02230d54475ed0408c41afd1d95
SHA256

7065924119adab65e2694c4960292ef118592142666efff9df470037b7689c34
SHA512

ca3069ee9d1334c9aab508d9506314c0c85c36b3fbe7b1d997f6b40cae100196962b7535ab1537d93c26e3a33a1c3bbddf745db322deda6b15582eca30dbd2cf
SSDEEP

49152:Up3lRs5X1QDfcMIneKmocKHffwpoEBUfdpoxPzIs61uoyOk/cHyl:IlRs5uDUMIneKmoX/YyEBUfdwIl1uoy3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 2908	1504	regsvr32.exe	90
PID 1504 wrote to memory of 2908	1504	regsvr32.exe	90
PID 1504 wrote to memory of 2908	1504	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ICCard.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ICCard.dll
  2⤵
  PID:2908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4460,i,2607710392823067546,4648797561512801463,262144 --variations-seed-version --mojo-platform-channel-handle=1300 /prefetch:8
1⤵
PID:4572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads