a8c453e85ccd4ca6a99e83036a736cc904b1b96b4a78d4e33c50c31136226a7a

Resubmissions

08-07-2022 07:45

08-07-2022 07:38

08-07-2022 07:36

08-07-2022 07:30

Target

boot_00430000.dll
Size

75KB
MD5

0ea80c1fd7481bc1fbfe86470069ec81
SHA1

6aaed5570b9af39ae45c43367d0cfa67c7199e42
SHA256

a8c453e85ccd4ca6a99e83036a736cc904b1b96b4a78d4e33c50c31136226a7a
SHA512

1a01e86a5901829e79bd8d625119cbb562228ccd0527bf17bb213209489937fa0bd4987171deaca88c434fb368831e3ee9a6a779be6d28662e4e57cfb7f40e5a

Score

5^/10

Drops file in System32 directory 1 IoCs

Processes:

PowerShell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

PowerShell.exe

pid process

1276 PowerShell.exe
1276 PowerShell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

PowerShell.exe

description pid process

Token: SeDebugPrivilege 1276 PowerShell.exe

pid	process
1276	PowerShell.exe
1276	PowerShell.exe

description	pid	process
Token: SeDebugPrivilege	1276	PowerShell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exePowerShell.exe

description	pid	process	target process
PID 4416 wrote to memory of 5004	4416	rundll32.exe	rundll32.exe
PID 4416 wrote to memory of 5004	4416	rundll32.exe	rundll32.exe
PID 4416 wrote to memory of 5004	4416	rundll32.exe	rundll32.exe
PID 1276 wrote to memory of 3320	1276	PowerShell.exe	rundll32.exe
PID 1276 wrote to memory of 3320	1276	PowerShell.exe	rundll32.exe
PID 1276 wrote to memory of 3320	1276	PowerShell.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\boot_00430000.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4416

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\boot_00430000.dll,#1
2⤵
PID:5004

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1680

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe" .\boot_00430000.dll,ReflectiveLoader
2⤵
PID:3320

memory/1276-131-0x00000290789D0000-0x00000290789F2000-memory.dmp

Filesize
136KB

Download
memory/1276-132-0x0000029078E90000-0x0000029078ED4000-memory.dmp

Filesize
272KB

Download
memory/1276-133-0x00007FFA0CEF0000-0x00007FFA0D9B1000-memory.dmp

Filesize
10.8MB

Download
memory/1276-134-0x0000029078F60000-0x0000029078FD6000-memory.dmp

Filesize
472KB

Download
memory/1276-135-0x00007FFA0CEF0000-0x00007FFA0D9B1000-memory.dmp

Filesize
10.8MB

Download
memory/1276-136-0x0000029078E60000-0x0000029078E7E000-memory.dmp

Filesize
120KB

Download
memory/3320-137-0x0000000000000000-mapping.dmp

Download
memory/5004-130-0x0000000000000000-mapping.dmp

Download