50796dc59c9c9579980ac7bd5f1abec02ec3bf62b2c5423c3b979ff45fac1590 | Triage

Analysis

max time kernel
137s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 11:43

Sharing

Report Analysis Logs

General

Target

DDOIProxy.dll
Size

14KB
MD5

96f444524ad3ab5bbee76acd2eb5be94
SHA1

2ee5fa6eacbe17e39398eacdbe593b3d21a7431b
SHA256

50796dc59c9c9579980ac7bd5f1abec02ec3bf62b2c5423c3b979ff45fac1590
SHA512

35a4849c59d88fc0d501ec47866ab6074a2e92194e2a8a1227f83c1c90abffe40877e484af2e6edb5ce67cb9cd3fd9814a8f4b8cea84f6c6cf10af6ed4cb0bcb
SSDEEP

384:cnieTxVI5t+DMEQoy6TNKYsTe5fXvs73Z5maWN7WsanT8:MTMXaQoXTNETepemhj

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 2116	3532	rundll32.exe	91
PID 3532 wrote to memory of 2116	3532	rundll32.exe	91
PID 3532 wrote to memory of 2116	3532	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DDOIProxy.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DDOIProxy.dll,#1
  2⤵
  PID:2116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3956 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:4284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads