37c65668410126486898dd2ea02374834219857a6836175b21be3568c6931da9 | Triage

Analysis

max time kernel
133s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 12:06

Sharing

Report Analysis Logs

General

Target

api-ms-win-core-file-l1-2-0.dll
Size

11KB
MD5

d3362e7ed2fed334339a32dfe44123de
SHA1

d419e2c92dc140d762242938c6c1e26718a422cd
SHA256

37c65668410126486898dd2ea02374834219857a6836175b21be3568c6931da9
SHA512

4f0ad99aee1354a6e9c3c5349aaf8547b12eb563b014f2fcfcbfebacfd7be7309b6571f7105e59085a2140f38e66f3f6c0a55ca0f482ed3c477163a8dff845e6
SSDEEP

192:P91WCu7hWNzBODBQABJ+UBqnaj87X/f4CXveNdHO1:DWphWmDBRJ+Al9ieNdu1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 3908	1056	rundll32.exe	92
PID 1056 wrote to memory of 3908	1056	rundll32.exe	92
PID 1056 wrote to memory of 3908	1056	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-core-file-l1-2-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-core-file-l1-2-0.dll,#1
  2⤵
  PID:3908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4236,i,1067197275908310731,12785105794523264014,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:8
1⤵
PID:3152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads