Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20251231-en - resource tags
- submitted
22/01/2026, 15:00
General
- Target edit.dll
- Size 1.4MB
- Sample260122-sdrb3sev2d
- SHA256 6a0f4ea2f4ba62e63cc8abac633ccefc97068eb2639eb9cfae6b26cfde7be1bf
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 2 IoCs
- Program crash 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\edit.dll,#11⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 1483⤵
- Program crash
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 32 -s 1923⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 32 -ip 321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3816 -ip 38161⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1180-1-0x00007FF9B9640000-0x00007FF9B96FE000-memory.dmp
memory/1180-3-0x00007FF9BA6F0000-0x00007FF9BA8E5000-memory.dmp
memory/1180-4-0x00007FF9B9640000-0x00007FF9B96FE000-memory.dmp
memory/1180-0-0x00007FF9BA6F0000-0x00007FF9BA8E5000-memory.dmp
memory/3816-2-0x0000000000820000-0x0000000000866000-memory.dmp