Analysis
-
max time kernel
122s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
04-03-2021 12:10
Static task
static1
Behavioral task
behavioral1
Sample
f.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
f.dll
-
Size
512KB
-
MD5
fa9b3dfdb4b97dfe0db5991472f89399
-
SHA1
5677f26e926c8c8d7f7bf7eb085a9e48549a268b
-
SHA256
3648fe001994cb9c0a6b510213c268a6bd4761a3a99f3abb2738bf84f06d11cf
-
SHA512
e5ac96e3ef6ee9fa110b433c1c49a7f16f4ba6694ec76e10d31848ecd4f284b6845508979758a16121a63d6c4a1af2103268d6e03fbb1c6672005090d560cc74
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 3936 set thread context of 952 3936 rundll32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 952 msiexec.exe Token: SeSecurityPrivilege 952 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 3996 wrote to memory of 3936 3996 rundll32.exe rundll32.exe PID 3996 wrote to memory of 3936 3996 rundll32.exe rundll32.exe PID 3996 wrote to memory of 3936 3996 rundll32.exe rundll32.exe PID 3936 wrote to memory of 952 3936 rundll32.exe msiexec.exe PID 3936 wrote to memory of 952 3936 rundll32.exe msiexec.exe PID 3936 wrote to memory of 952 3936 rundll32.exe msiexec.exe PID 3936 wrote to memory of 952 3936 rundll32.exe msiexec.exe PID 3936 wrote to memory of 952 3936 rundll32.exe msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/952-5-0x0000000000000000-mapping.dmp
-
memory/952-6-0x00000000023B0000-0x00000000023E4000-memory.dmpFilesize
208KB
-
memory/3936-2-0x0000000000000000-mapping.dmp
-
memory/3936-3-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/3936-4-0x0000000003030000-0x0000000003031000-memory.dmpFilesize
4KB