755d11ba3943ba14071f4bdb5b10d3a1db96fdbf637a2851317304aa2523a4b4 | Triage

Analysis

max time kernel
136s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 09:12

Sharing

Report Analysis Logs

General

Target

Plugins/reaper_cd.dll
Size

38KB
MD5

75dde8239ef611edf6c713c068291608
SHA1

83c82b7229047b21065964f9d9d46160b37bfede
SHA256

265869eaca9f3c3cea99cc6c5c705a21d874a2413f52dd6602f9d5c17c03caab
SHA512

cb550de0c7c040730963619ce7ebf1ff867598e0b8f9dd89aba735175a2ecb32030315b6e638419c03318dd0d522a898e6e528f259b063a9f4e2515fae87dc75
SSDEEP

768:lkQcGaLvZHlJF+ACpk5rWjE8N5XO+v249lRza:l7axHFROu8/nFRz

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 2728	4468	rundll32.exe	89
PID 4468 wrote to memory of 2728	4468	rundll32.exe	89
PID 4468 wrote to memory of 2728	4468	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\reaper_cd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\reaper_cd.dll,#1
  2⤵
  PID:2728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1348 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:1912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads