347a71e1000b6ff4da40ec8b5cf3052b86afa1b2aaadf21dd21fa4564a911646 | Triage

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 05:38

Sharing

Report Analysis Logs

General

Target

FoxitShrinkSetup.dll
Size

2.3MB
MD5

84c5d7119a7694d1241d2203247be6dd
SHA1

374e6b6a89ac9dc0c01aa3c40ed9b35f03db3af9
SHA256

adbd7d17e5d4be11198af5ccad69ba18f9e3157871f68562dde2dd67d9bf1b75
SHA512

f391e027b6aa4bc46a6f6b20756be436c764a96a90eb9643d126542f048cf59f97587b7b9ab95b5545c6fbe66cd540d14ed5b328110100af43cc3c711099a839
SSDEEP

49152:8dDSu+1o4uj276ggAqNrL5tj1XUNgASK4CTfVf1WZ62dC4FKPTzEaT92:8dIobmgAeC4IEaB2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 5004	2812	rundll32.exe	90
PID 2812 wrote to memory of 5004	2812	rundll32.exe	90
PID 2812 wrote to memory of 5004	2812	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FoxitShrinkSetup.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\FoxitShrinkSetup.dll,#1
  2⤵
  PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3996 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:5472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads