996b01e15f85e165899630721a141b178a9c372b6e878012180ec9e9d4e7bd06 | Triage

Analysis

max time kernel
134s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 14:16

Sharing

Report Analysis Logs

General

Target

sas.dll
Size

8KB
MD5

969d1f85151e0156d51a664e59a50213
SHA1

777735cf24fe880d00a205b5bcc79ca8df8d660b
SHA256

996b01e15f85e165899630721a141b178a9c372b6e878012180ec9e9d4e7bd06
SHA512

73f9a14d297f7dddc9e3d9b0db6cd4160cd000f31f437ea8add7d95de2f704482fa891996f2df048def3371cc9245a2efa31b2d0647a7cc1e6848db7b809e711
SSDEEP

192:l5UGq/4LYix0kmAEE8O5cTbOVT66o+1WX6wW/:nr5YiWXAjHGOVZP1WX6wW

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2112	2748	rundll32.exe	91
PID 2748 wrote to memory of 2112	2748	rundll32.exe	91
PID 2748 wrote to memory of 2112	2748	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sas.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\sas.dll,#1
  2⤵
  PID:2112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4288,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:8
1⤵
PID:4496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads