035c1959eb274806f26b2e6c29d13152eeacb976560de99a331b4ece1de367b8 | Triage

Analysis

max time kernel
17s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 19:12

Sharing

Report Analysis Logs

General

Target

madCHook.dll
Size

123KB
MD5

369d077a89a03823debf94ed5e0dfcd1
SHA1

a14bdc948373e84b24798e20a7e91d59ad67c8ba
SHA256

a9a1e9fa16890d4b51b514adddec3e5592fbf2ee25611029c67c813225c54ee9
SHA512

5506c4f8022fc9d607f86e59e1aceab2c29c6eac721604e308fb6e26134a88061c06929e5a13409555e660d4e957943306e7cc35eb917bd262496726926ac5b5
SSDEEP

3072:Yfx6nz7ixioxKHncfwUi8yqEZ6vMDPYnDa+nER:2x6z7ixrC/qfnDa+n

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 18 IoCs

Processes:

rundll32.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1764	rundll32.exe
Token: SeSecurityPrivilege	1764	rundll32.exe
Token: SeTakeOwnershipPrivilege	1764	rundll32.exe
Token: SeLoadDriverPrivilege	1764	rundll32.exe
Token: SeSystemProfilePrivilege	1764	rundll32.exe
Token: SeSystemtimePrivilege	1764	rundll32.exe
Token: SeProfSingleProcessPrivilege	1764	rundll32.exe
Token: SeIncBasePriorityPrivilege	1764	rundll32.exe
Token: SeCreatePagefilePrivilege	1764	rundll32.exe
Token: SeShutdownPrivilege	1764	rundll32.exe
Token: SeDebugPrivilege	1764	rundll32.exe
Token: SeSystemEnvironmentPrivilege	1764	rundll32.exe
Token: SeRemoteShutdownPrivilege	1764	rundll32.exe
Token: SeUndockPrivilege	1764	rundll32.exe
Token: SeManageVolumePrivilege	1764	rundll32.exe
Token: 33	1764	rundll32.exe
Token: 34	1764	rundll32.exe
Token: 35	1764	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1980 wrote to memory of 1764	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 1764	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 1764	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 1764	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 1764	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 1764	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 1764	1980	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\madCHook.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\madCHook.dll,#1
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1764-54-0x0000000000000000-mapping.dmp

Download
memory/1764-55-0x0000000075891000-0x0000000075893000-memory.dmp

Filesize
8KB

Download