b6138bd31f0930d6f489ac8ef0dad8333b30bcebc51c0940b19ab4cb3ffbab73 | Triage

Analysis

max time kernel
140s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 04:33

Sharing

Report Analysis Logs

General

Target

YXCapture.dll
Size

607KB
MD5

5c67357fca4bbebb215b8dbf1d617300
SHA1

4e56bef46f87ede792cb8015eff59eb430896627
SHA256

96290694a953e721c87d1b30c02190598f93a77e9f58fe0c0e584d5214a3a27e
SHA512

e24bd58be87bca99f5e68096fef7a3ea067d26146142dd1e53279bbb60207783562f2d9732bb257e68b3f75a1ab46129def472e3c76f1500f92a5f0c56df98a2
SSDEEP

12288:Bl6rwCkTDoxkYbAQpJUnFDQnCWK9tmyDHdmNs:Bl6r9AKI2nCTKit

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 4892	1384	rundll32.exe	90
PID 1384 wrote to memory of 4892	1384	rundll32.exe	90
PID 1384 wrote to memory of 4892	1384	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\YXCapture.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\YXCapture.dll,#1
  2⤵
  PID:4892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3180 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:1388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads