0c860b7f821fc9d1ac0d91410201743febcf459b95c848529a8f816a9309a240 | Triage™

Analysis

max time kernel
142s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ikutmco.dll
Size 205KB
Sample240612-2t4f1stfmg
SHA256 bfb6787c2c30e17d22d252f674470f5146fc631d192024464b61157914115066
MD5 26034082bf720e4f732db63ef9b9ba8f
SHA1 2e370817a138989026e85b1e62f147505d1ae63d
SHA512 1ebd785ead8e911dfa573c4f03ee4e13fd9841d29219749e369d2223ff646eaf19b607bb0bb6a7d10c5e5b8ad586b8ef9e5506b1af4b6d167f0803493900d4fb
SSDEEP 3072:seHVsgHL6FQVtAJAPuKh2r80Se83QIOUbaS:vrmWn2QrQ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4892	1448	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 1448	4056	rundll32.exe	91
PID 4056 wrote to memory of 1448	4056	rundll32.exe	91
PID 4056 wrote to memory of 1448	4056	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ikutmco.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ikutmco.dll,#1
  2⤵
  PID:1448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 644
    3⤵
    - Program crash
    PID:4892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1448 -ip 1448
1⤵
PID:2216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4024 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:3248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads