00f1020463841d00ba0eb7e52a655106d7ce340358324c39b7ff0a64a6489d9b | Triage

Analysis

max time kernel
137s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 01:29

Sharing

Report Analysis Logs

General

Target

DSC080.dll
Size

115KB
MD5

e0f74c9fde49b76fab5b2b573a229478
SHA1

90416b05807bd27bda40cc57992743706ab69cba
SHA256

46bda60a69c0042fa6ee8be8f20fa0148fd99b3b93807078e04ab636f2b8315e
SHA512

f23568ce2306492f264b6ee3ccf5f3ec4b83ca0c8c24c747da948982334a2a22efa7663c52132102369809b09f2185794d35e23d518bf75e82b7b03386a99447
SSDEEP

3072:IuRguCGyJnyLR2NHqQYDLiRsM+seMdsdVwuZwvhmKw:5g/Xo1AqQzeMdsdVwu2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 540	1480	rundll32.exe	91
PID 1480 wrote to memory of 540	1480	rundll32.exe	91
PID 1480 wrote to memory of 540	1480	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DSC080.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DSC080.dll,#1
  2⤵
  PID:540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:4024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads