ed5cc4c4878fb3433c853b6129232a6dd8da5eded42eba915e8c52ac0c201e7e

Analysis

Target
ed5cc4c4878fb3433c853b6129232a6dd8da5eded42eba915e8c52ac0c201e7e.dll
Size 966KB
Sample220205-s2hd3scgg8
SHA256 ed5cc4c4878fb3433c853b6129232a6dd8da5eded42eba915e8c52ac0c201e7e
MD5 48d1f61b52efd01a2ca8c05ff882f390
SHA1 2ad6b66303680ba83ceec047263c923181e75577
SHA512 c708ef0e8259747c7813d2122f7badf0672dfd434af19925bcbfd2a648162d48ca32cde6c735d96e6f948846fa89d13f96c196cf06c8c4b28c25befc2b28cef9
MD5 SHA1 SHA512

Score

4^/10

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2220	svchost.exe
Token: SeCreatePagefilePrivilege	2220	svchost.exe
Token: SeShutdownPrivilege	2220	svchost.exe
Token: SeCreatePagefilePrivilege	2220	svchost.exe
Token: SeShutdownPrivilege	2220	svchost.exe
Token: SeCreatePagefilePrivilege	2220	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 4500	3736	regsvr32.exe	82
PID 3736 wrote to memory of 4500	3736	regsvr32.exe	82
PID 3736 wrote to memory of 4500	3736	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ed5cc4c4878fb3433c853b6129232a6dd8da5eded42eba915e8c52ac0c201e7e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ed5cc4c4878fb3433c853b6129232a6dd8da5eded42eba915e8c52ac0c201e7e.dll
  2⤵
  PID:4500

memory/2220-130-0x0000028F95B70000-0x0000028F95B80000-memory.dmp

Download

memory/2220-131-0x0000028F96630000-0x0000028F96640000-memory.dmp

Download

memory/2220-132-0x0000028F98B40000-0x0000028F98B44000-memory.dmp

Download