9df96f432cbf06b20c3f8ea221db539479dfc1fde7da62bcd5cf0e6686f9ec15

Analysis

Target
9df96f432cbf06b20c3f8ea221db539479dfc1fde7da62bcd5cf0e6686f9ec15.dll
Size 1.0MB
Sample220205-s2g4badbaq
SHA256 9df96f432cbf06b20c3f8ea221db539479dfc1fde7da62bcd5cf0e6686f9ec15
MD5 27294624320c2aafab94f3d29764b28a
SHA1 af4ef0743f6c5282ede2c3854e17f52948494426
SHA512 5da170496fc042cfe8956ddd97b908a1be3f66d9697c42d7ac13492af41c043970cef6196a43d0aafa9d8cf31ca4fda27782dbe685caa28a94c26440386a0f8a
MD5 SHA1 SHA512

Score

4^/10

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1580	svchost.exe
Token: SeCreatePagefilePrivilege	1580	svchost.exe
Token: SeShutdownPrivilege	1580	svchost.exe
Token: SeCreatePagefilePrivilege	1580	svchost.exe
Token: SeShutdownPrivilege	1580	svchost.exe
Token: SeCreatePagefilePrivilege	1580	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3112 wrote to memory of 2288	3112	regsvr32.exe	82
PID 3112 wrote to memory of 2288	3112	regsvr32.exe	82
PID 3112 wrote to memory of 2288	3112	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9df96f432cbf06b20c3f8ea221db539479dfc1fde7da62bcd5cf0e6686f9ec15.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3112
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9df96f432cbf06b20c3f8ea221db539479dfc1fde7da62bcd5cf0e6686f9ec15.dll
  2⤵
  PID:2288

memory/1580-130-0x00000238D9B80000-0x00000238D9B90000-memory.dmp

Download

memory/1580-137-0x00000238DCF60000-0x00000238DCF64000-memory.dmp

Download