Analysis

  • max time kernel
    140s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    13-02-2022 22:36

General

  • Target

    046235b59fbc6d2c4ec3db0ae6ea10cb53d743c678ca9dca8b2a9d30c7fbb393.dll

  • Size

    163KB

  • MD5

    a1cc9b5d85c55d1679cee3a11500fc15

  • SHA1

    dcb776035a4f6140d86a8acbac48683035cec701

  • SHA256

    046235b59fbc6d2c4ec3db0ae6ea10cb53d743c678ca9dca8b2a9d30c7fbb393

  • SHA512

    12220589d5e0f14c07fed9fdb1e5dd24cd518decc7719faa2b95de664be324204ddf4a3dafaf9d49c4932192c27bff501d02a4a1c65c427eae9d414b203a668a

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\046235b59fbc6d2c4ec3db0ae6ea10cb53d743c678ca9dca8b2a9d30c7fbb393.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1316
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\046235b59fbc6d2c4ec3db0ae6ea10cb53d743c678ca9dca8b2a9d30c7fbb393.dll,#1
      2⤵
        PID:1524
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
      1⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4632
    • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
      C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
      1⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:2508

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4632-130-0x000001E06B560000-0x000001E06B570000-memory.dmp

      Filesize

      64KB

    • memory/4632-131-0x000001E06BB20000-0x000001E06BB30000-memory.dmp

      Filesize

      64KB

    • memory/4632-132-0x000001E06E1B0000-0x000001E06E1B4000-memory.dmp

      Filesize

      16KB