09f4522407d2621ea90e79f85af26bf090146fb38f33b516d970ad825194c6b4 | Triage

Analysis

max time kernel
132s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 12:47

Sharing

Report Analysis Logs

General

Target

SWind.dll
Size

152KB
MD5

f5c2bc3da7f755a5b9a7ccf9008fc8b2
SHA1

543b335163413d86ff1892d3c9e9b485ed2cdc88
SHA256

09f4522407d2621ea90e79f85af26bf090146fb38f33b516d970ad825194c6b4
SHA512

049aa162d1f4c37c7e0c074b999cab8aee3fafcc38044acb7cf69e3122164cb127ef16c5c73d4e59f582e5a5877f0bce2cad14f87426fdc681b9e1627cb83740
SSDEEP

3072:G0xJDEOuV1eVZeYQZ3vgoVJu8i8IPHHl:FVuYV268aH

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1544	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 1544	1072	rundll32.exe	90
PID 1072 wrote to memory of 1544	1072	rundll32.exe	90
PID 1072 wrote to memory of 1544	1072	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SWind.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SWind.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3608,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:8
1⤵
PID:4532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads