2dc4c306da01adebbc2304f3d82d009bc3ca4a097209e4f6dd5400ef4f93cbc8 | Triage

Analysis

max time kernel
130s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 04:54

Sharing

Report Analysis Logs

General

Target

HShield/Bz32Ex.dll
Size

80KB
MD5

1d64f5adb11e688137a12ec4504f8520
SHA1

088864c456c14716f6a91f57702ad088102727bf
SHA256

1fdc007d96f90d675e67550569ad3c99f88ea13d7d603e36d99d43cb4de61e4f
SHA512

0d7286ee32c0e76adab2b906c339b01096f5bc39d1c172f7d87a63f7d4664227920401ce1e72082464ee383793541663f25fa02f1738bda43293a9ad6a89eedc
SSDEEP

1536:j9lZZfvvf/d3CzKLE1o1inxUg0bb5ROpVUvV7t8td:nZdvvfJCzCinxd0xRiWV7itd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 1708	2312	rundll32.exe	90
PID 2312 wrote to memory of 1708	2312	rundll32.exe	90
PID 2312 wrote to memory of 1708	2312	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HShield\Bz32Ex.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\HShield\Bz32Ex.dll,#1
  2⤵
  PID:1708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3756,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
1⤵
PID:4868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads