Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20251229-en - resource tags
- submitted
22/01/2026, 15:00
General
- Target edit.dll
- Size 1.4MB
- Sample260122-sdrb3sev2d
- SHA256 6a0f4ea2f4ba62e63cc8abac633ccefc97068eb2639eb9cfae6b26cfde7be1bf
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 2 IoCs
- Program crash 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\edit.dll,#11⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 2043⤵
- Program crash
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 2043⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1688 -ip 16881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1956 -ip 19561⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/420-0-0x00007FFF2D240000-0x00007FFF2D449000-memory.dmp
memory/420-1-0x00007FFF2C6F0000-0x00007FFF2C7AD000-memory.dmp
memory/420-5-0x00007FFF2D241000-0x00007FFF2D36A000-memory.dmp
memory/420-4-0x00007FFF2C6F0000-0x00007FFF2C7AD000-memory.dmp
memory/420-3-0x00007FFF2D240000-0x00007FFF2D449000-memory.dmp
memory/1956-2-0x0000000000D80000-0x0000000000DC6000-memory.dmp