ba090f00dec7afbd561670d2a345193fe2d8c10688aa3b5c73972918d1a55a4a | Triage

Analysis

max time kernel
142s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-06-2024 05:25

Sharing

Report Analysis Logs

General

Target

BuildProps.dll
Size

14KB
MD5

a8fcc3d0fadc011a22300b4f457f1df1
SHA1

9c36f52b846ab552cb8ce81f0bbd2d3f9046c828
SHA256

d3d1921f7665f857f8dfa05affc3d7c8ce687171f9eeffbbf5b15e5915717b41
SHA512

97acc585189672b5621dcfcd15a4c2138c2354f997e206e64052b931cdb152716f121aacf4a5aa554ffbea010887b236e67832a7237187f26ec4a9b710947ee9
SSDEEP

192:XteCwPRBXjfdcZxQNAVyowJL/eRoeuJafjMNfzg54X8jSJUbueqYZHp:IZfyZxQGVYJLea8oNE54XdUb+ep

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3640 wrote to memory of 2916	3640	rundll32.exe	rundll32.exe
PID 3640 wrote to memory of 2916	3640	rundll32.exe	rundll32.exe
PID 3640 wrote to memory of 2916	3640	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\BuildProps.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3640

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\BuildProps.dll,#1
2⤵
PID:2916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3804 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:1716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...