b89486615e9d50de29121851eb142207202c5aa9bc948ea0cfcad5016d5acc08 | Triage

Resubmissions

28/06/2024, 16:48

240628-vbh9ssxakg 8

28/06/2024, 16:39

240628-t58acawhkh 8

Analysis

max time kernel
1154s
max time network
1199s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 16:48

Sharing

Report Analysis Logs

General

Target

WebView2Loader.dll
Size

114KB
MD5

91ad16b368c7703e9b3d7ac665d67a47
SHA1

95c801d6d350a5820607253c7a3b7df527651575
SHA256

5659cbae9f3d412662515671a6c85aefe08eee17118c3de1330a2fed74dc415f
SHA512

cad3a972eee03acb3e8ea4d5d1d306eba0e2ff65388250ebeb65fb36ce0def82323487a70a9fce0d8ddf633f68a12619b3650a1bf2e2ce4876c47f5ec023396d
SSDEEP

3072:1ny/h/lA9t2JqgDyBGFHyklk3QKHS8TXoEtpAlyh0uchBa:A/lct2JFkxk9Etiwzcva

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
828	4024	WerFault.exe	98

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 4024	4900	rundll32.exe	98
PID 4900 wrote to memory of 4024	4900	rundll32.exe	98
PID 4900 wrote to memory of 4024	4900	rundll32.exe	98

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WebView2Loader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WebView2Loader.dll,#1
  2⤵
  PID:4024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 600
    3⤵
    - Program crash
    PID:828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4024 -ip 4024
1⤵
PID:3200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4228,i,7869973516895866428,11647313872437892197,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
1⤵
PID:2500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads