24752b8ff4feca02ec8b8a444abb659ba1362f2a48da876d6335d8270df6382c | Triage

Analysis

max time kernel
146s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 11:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

WebServices20200729.dll
Size

6KB
MD5

2c1dd0db1ad8c39bfad16c10e6a531cd
SHA1

a8aa7071954ae8fc917f03c0f84855c657147ae7
SHA256

24752b8ff4feca02ec8b8a444abb659ba1362f2a48da876d6335d8270df6382c
SHA512

12aaae78310a3761c1dc43ee0e242f350e3203008800c16e3a820ff44a5bd4bfe00085df24317f63fb89d53030270b5f412113ad320ada576ea7d8ad3c9038ef
SSDEEP

96:K8cUZfLEB/Agg/SnGiLrLPSCGQ+uttf6u7Yr:K8rwB/AgCgG2rIuOqs

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 4524	1788	rundll32.exe	90
PID 1788 wrote to memory of 4524	1788	rundll32.exe	90
PID 1788 wrote to memory of 4524	1788	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WebServices20200729.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WebServices20200729.dll,#1
  2⤵
  PID:4524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4300,i,18168883380598738769,14202261231630113808,262144 --variations-seed-version --mojo-platform-channel-handle=1040 /prefetch:8
1⤵
PID:5028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads