76238af88d9a95bd3c17b150465d6dc8f0734d9b25670d8bd10d63559a55b615 | Triage

Analysis

max time kernel
141s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 06:53

Sharing

Report Analysis Logs

General

Target

DMSharedClasses.dll
Size

56KB
MD5

5112e5f05daac0e8f5f5972b9f8555ac
SHA1

519021c203729adb3638609d01769f5f8ad0c474
SHA256

f66698c9cfa4c9bb88c9e8fa655970e5803e35f7b7d2eb70b47f3a65d0155f7a
SHA512

07b584d465a0f6900224cdae8a26fc1df4478ac8802ccbbca076388f60557315ab4b94f9643031c64a678f735345b032910d043b7e4371dc5a9ff23ce28a56f7
SSDEEP

1536:Xm9fs+I6dH5DTNA2FFQRus7Zpe+P4uxm:XilI6dH5DW2pslJm

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 3224	1188	rundll32.exe	90
PID 1188 wrote to memory of 3224	1188	rundll32.exe	90
PID 1188 wrote to memory of 3224	1188	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DMSharedClasses.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DMSharedClasses.dll,#1
  2⤵
  PID:3224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:2776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads