c55732168517ea7a91d294844d2e32da201bb31e95ec484f68f29fa5efb5e08b | Triage

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2024 17:04

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/inetc.dll
Size

61KB
MD5

8bde726084a37cacd13a7e03259f953f
SHA1

25400124fe8b399d659d5853f45e388a5a53b61a
SHA256

19a8e8aaa8a8d6c6e49ffd054b1c62f562eda5909aa6e7863c65c5f858f5fd18
SHA512

2f4932fade786312ba72c0f12d51bb1e561fd939597983dceccc0f0d7a53f18862f362473620c0788be039bb4977f0e23b541c61d67ab0ba9a043be963694b23
SSDEEP

768:IWAGVKaWi9rA8RhcTG3HvTIVQf3EczqWhP6v4d18a18Gvp23+zjB:IWRZ1zcybIm3EcNhUM8K8/0B

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 656	2620	rundll32.exe	91
PID 2620 wrote to memory of 656	2620	rundll32.exe	91
PID 2620 wrote to memory of 656	2620	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1
  2⤵
  PID:656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1324 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:5472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads