Analysis
-
max time kernel
131s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 18:36
Static task
static1
Behavioral task
behavioral1
Sample
015fcede68af41154bd20c6719c575fd802ddd998a904320c95e15a2d749560b.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
015fcede68af41154bd20c6719c575fd802ddd998a904320c95e15a2d749560b.dll
Resource
win10v2004-20240611-en
General
-
Target
015fcede68af41154bd20c6719c575fd802ddd998a904320c95e15a2d749560b.dll
-
Size
9.4MB
-
MD5
0d13eeee70f9a61e8dd688f5b46cd6c9
-
SHA1
0be931fabf5aa9a4781d132776c8a4a19f1646e3
-
SHA256
015fcede68af41154bd20c6719c575fd802ddd998a904320c95e15a2d749560b
-
SHA512
d606cfa03a2baa7921d4c2d88c79fa25ef59fe8feec9697e4158dd91c35c94b29a9275fabdce824372dedef3f04acce2d293b2aba5a9c06099d01cdb5ec5df8e
-
SSDEEP
196608:NiaLRs/c3YsJbqm+Zd6XTQYTSJjYXlQpfRU:Ni09YsJbqz6XTQYT6YVQt
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4148 wrote to memory of 3220 4148 rundll32.exe rundll32.exe PID 4148 wrote to memory of 3220 4148 rundll32.exe rundll32.exe PID 4148 wrote to memory of 3220 4148 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\015fcede68af41154bd20c6719c575fd802ddd998a904320c95e15a2d749560b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\015fcede68af41154bd20c6719c575fd802ddd998a904320c95e15a2d749560b.dll,#12⤵PID:3220
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3044,i,12594301322143882025,16832588342008839449,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:81⤵PID:4420