a67841ce6c21b1e48913310654d1501e691052a92369dfcefa1f24690e834ed4 | Triage

Analysis

max time kernel
124s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2024 19:39

Sharing

Report Analysis Logs

General

Target

PP2008/CMUpnp.dll
Size

80KB
MD5

8cb8322b8690b383fa74a4603e745e6d
SHA1

693640170675e5552dbeb873c456f23c9a5ef9c3
SHA256

98b8baccc7c5442e08bebefc1ae7d1b8c5fb3fa899b96addd687f049bf6432b0
SHA512

4c18dc34668bded85b70f8fa7993e90ac2f12e06811ca44ed5ed08d899051889b46c40a0db0d358c27a981c570453062a5fba3d01219956b206e295a92f7bd6d
SSDEEP

1536:Ol4F0ybIvCENPfyXJG98t66AwJ8krv7CsGYPl3:OG0ybOCysH6gN+1YPl3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 2252	3644	rundll32.exe	89
PID 3644 wrote to memory of 2252	3644	rundll32.exe	89
PID 3644 wrote to memory of 2252	3644	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PP2008\CMUpnp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PP2008\CMUpnp.dll,#1
  2⤵
  PID:2252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1336,i,15721081447618313297,6839074028983272033,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
1⤵
PID:4268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads