1741be55d741c6d4cba3d685241aa1f10c05517bc6dab5392ce4b4f945ff184e | Triage

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 22:26

Sharing

Report Analysis Logs

General

Target

WebEx/atinet.dll
Size

28KB
MD5

eab06f7bf49098521e917fcdf81d3ec4
SHA1

f4a1695f974203947576131afcb49e0066b47f8a
SHA256

fcaf3cacd43c567f793aefd60f67915381af7401662b500d60c07f08d636d18b
SHA512

b529c6263f4f0d9dc04c736d0534bf709d2edf2d9fb4dc5a09a798e734010b59dd05e3a5daec0bdab05b9b96839fe29433da0f3dc12f9a848663bd54e721edbd
SSDEEP

192:U6aB0Wdsm1xx5mJ4RtRKgP2rIg77d5UNwyyk4:UlC2ggRKgPWIw7PUtz

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 2640	4000	rundll32.exe	91
PID 4000 wrote to memory of 2640	4000	rundll32.exe	91
PID 4000 wrote to memory of 2640	4000	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WebEx\atinet.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WebEx\atinet.dll,#1
  2⤵
  PID:2640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3832 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:2596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads