Resubmissions
25/10/2021, 09:39
211025-lmzw9aghbp125/10/2021, 09:33
211025-ljfzzagaa51025/10/2021, 07:58
211025-jttygaggdk1Analysis
- max time kernel
117s - max time network
117s - platform
windows7_x64 - resource
win7-en-20211014 - submitted
25/10/2021, 07:58
General
- Target PO # RSLDH102115239.xll.dll
- Size 637KB
- Sample211025-jttygaggdk
- SHA256 994013d66ae20cfa4ef1097d73481b00a672131d0de44d79a04ff12f492aae55
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s "C:\Users\Admin\AppData\Local\Temp\PO # RSLDH102115239.xll.dll"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Users\Admin\AppData\Local\Temp\PO # RSLDH102115239.xll.dll"2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/796-57-0x00000000764D1000-0x00000000764D3000-memory.dmp
memory/796-58-0x0000000000420000-0x0000000000437000-memory.dmp
memory/796-61-0x0000000000CF2000-0x0000000000CF3000-memory.dmp
memory/796-60-0x0000000000CF1000-0x0000000000CF2000-memory.dmp
memory/796-63-0x0000000000CF4000-0x0000000000CF6000-memory.dmp
memory/796-62-0x0000000000CF3000-0x0000000000CF4000-memory.dmp
memory/796-64-0x0000000004860000-0x0000000004896000-memory.dmp
memory/796-65-0x0000000000CFA000-0x0000000000D0B000-memory.dmp
memory/796-66-0x0000000000AC0000-0x0000000000AC2000-memory.dmp
memory/1524-55-0x000007FEFBDC1000-0x000007FEFBDC3000-memory.dmp