09e65a661e85c3a3ab0e848809e44f20332b9f46cf5da364c7c8d3992c957f85 | Triage

Resubmissions

17-06-2024 17:37

240617-v7lpssxfke 10

14-06-2024 20:15

240614-y1wg7sthng 10

Analysis

max time kernel
216s
max time network
306s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17-06-2024 17:37

Sharing

Report Analysis Logs

General

Target

Bull140U.dll
Size

3.2MB
MD5

b5ac5913784d34c843677547edd5c578
SHA1

ed2a4e165ad8b65b1699aaf048654142a66943c6
SHA256

3267244255376bfaf68e75ad38468ba3ca0bbb49fe260f6e05611148d5cee3c9
SHA512

28a29ff02d7ce6d6a74b4938a1a1388c4ad6b36600bc9e7664edf14eb8a89aee49c107c46e13aee0194a38ec506cd86094952ce9327d724a98541871ff58d6db
SSDEEP

49152:YucCrMCcHiNTP0aVY+cTiPA+uo8TWp1gbuDIc7TYgZwnlmd2:neCtVYfbnoQbhPn

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1572 wrote to memory of 5076	1572	regsvr32.exe	regsvr32.exe
PID 1572 wrote to memory of 5076	1572	regsvr32.exe	regsvr32.exe
PID 1572 wrote to memory of 5076	1572	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Bull140U.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1572

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\Bull140U.dll
2⤵
PID:5076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3504 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...