dae8b56e57d10b540c1664c824fe0dfb6316a8dee0722d1d57b7961147cd857c | Triage

Analysis

max time kernel
121s
max time network
38s
platform
windows7_x64
resource
win7v20210410
submitted
26-07-2021 19:48

Sharing

Report Analysis Logs

General

Target

dae8b56e57d10b540c1664c824fe0dfb6316a8dee0722d1d57b7961147cd857c.dll
Size

299KB
MD5

4e6ac23cf16f054b9b79ccbe0e486f82
SHA1

0c4572af283c893d87c6040b795150ab55ec0577
SHA256

dae8b56e57d10b540c1664c824fe0dfb6316a8dee0722d1d57b7961147cd857c
SHA512

73327aaa38b9949219f2d19358f8a8b217d0022483af19acaf75ee3c702205bfbb58915462c7f8760bd27a5ea972b8e7118b572d37c954a2ebb53c672c171817

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\rundll32.exe: $TASK	rundll32.exe
File opened for modification	C:\Windows\system32\rundll32.exe: $FILE	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1632	taskeng.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 992	1632	taskeng.exe	30
PID 1632 wrote to memory of 992	1632	taskeng.exe	30
PID 1632 wrote to memory of 992	1632	taskeng.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dae8b56e57d10b540c1664c824fe0dfb6316a8dee0722d1d57b7961147cd857c.dll,#1
1⤵
- Drops file in System32 directory
PID:640

C:\Windows\system32\taskeng.exe
taskeng.exe {332F5743-5852-4B37-B319-25EDD93F9494} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\system32\rundll32.exe
  C:\Windows\system32\rundll32.exe -u
  2⤵
  PID:992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads