0bdc115aef8d58d2268275c231838e9cbd0c0b2a341fce80472f6ec83cf3e3fb | Triage

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 07:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Recover My Files v4/StarBurn.dll
Size

555KB
MD5

19f5a638948eb5d413c89ae62d1320ad
SHA1

431a8bb70a8754dbb8e2e2e26def6e1b1f30f477
SHA256

372a719d73ecb4d48c8b7d1654f167d5de0f73b4772b757cd60cf80f19d859a7
SHA512

5fa90c430b186e5d764cf75a12a3e9fe7447ba21d1a42231ec7b6f5f32c12dc46890af6919c9e723b3f85f3c5a83bd8b184a5020e3c72df39b2c2279c9375a25
SSDEEP

12288:k/gzbnMa1JPxCv4g14xdrt8kQaYfAc+IM6TG7H8:8x6g4gexdr+paYfAc+4G7c

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2676	4308	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 4308	904	rundll32.exe	90
PID 904 wrote to memory of 4308	904	rundll32.exe	90
PID 904 wrote to memory of 4308	904	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Recover My Files v4\StarBurn.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Recover My Files v4\StarBurn.dll",#1
  2⤵
  PID:4308
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 624
    3⤵
    - Program crash
    PID:2676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4308 -ip 4308
1⤵
PID:4596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3984 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:5536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads