94fef3ee9512941ff1aa4c8a951598ae67c42b71fbc047d28f3164570497d0b0 | Triage

Analysis

max time kernel
131s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 03:43

Sharing

Report Analysis Logs

General

Target

EngineApiWrapper.dll
Size

174KB
MD5

e7b3a04330517223ccac06e69a19591f
SHA1

f095a99e6fecda3652203e9e45bc53b32f7017f8
SHA256

f303484b154f87be0c2d14f564b0e460caf752b1ecce53095b447ea70021bda0
SHA512

837522b5deb0e30dff0b7566050f067946335cc8ee1e4e835135bc0dbea459ba933f4dff88d18e764a11fdcbda7974ecc1c28b67ca1e0e57d54a435acd586965
SSDEEP

3072:CaXkbRmkwLAGDsN5VZj4FMB3VXf56gd3nIouCOtaJQ:s0kgOVSE6OTvOtaO

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 3256	4656	rundll32.exe	93
PID 4656 wrote to memory of 3256	4656	rundll32.exe	93
PID 4656 wrote to memory of 3256	4656	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\EngineApiWrapper.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\EngineApiWrapper.dll,#1
  2⤵
  PID:3256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4200,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:8
1⤵
PID:3264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3256-1-0x0000000002600000-0x00000000027A4000-memory.dmp

Filesize
1.6MB

Download