d88e7a747d4889013c3b2eea2a99d28f4a559d8801296906476d8475a1967fda | Triage

Analysis

max time kernel
130s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 20:44

Sharing

Report Analysis Logs

General

Target

_gdi_.dll
Size

704KB
MD5

d84d3aa176f2c2da335dec901fa55cbc
SHA1

946ba1138b5c9f006698d611515cc96c2188834a
SHA256

acc6701c21b891a86dfbb025d350347c1f6f04411edc99b4b84145f8c6f04286
SHA512

7f1c626743c58ad93ad3f294d27e329aaae29d4e061a8a751fbb9fdc072c569ca9b8fae2521ec65ced32ec7a886d0e19230cc5086c39defc3b78aa47707888c4
SSDEEP

12288:XMVrEj7DI/kY4FZvzaUOrNupDzQl1WqMqh11iUQPJdXEaBRAQn:cVrEj7DekY4Ft+EJbqJh18PP1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 2552	4272	rundll32.exe	90
PID 4272 wrote to memory of 2552	4272	rundll32.exe	90
PID 4272 wrote to memory of 2552	4272	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\_gdi_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\_gdi_.dll,#1
  2⤵
  PID:2552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4236,i,1400471177590024469,587385956640537806,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:8
1⤵
PID:2236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2552-2-0x00000000026A0000-0x00000000026F6000-memory.dmp

Filesize
344KB

Download
memory/2552-0-0x0000000002570000-0x00000000026A0000-memory.dmp

Filesize
1.2MB

Download
memory/2552-4-0x0000000002760000-0x0000000002A6A000-memory.dmp

Filesize
3.0MB

Download