e8d81e7b25128035e30e271708d66efaf12c490114042e1e493a0c816d374414 | Triage

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
17-05-2023 21:32

Sharing

Report Analysis Logs

General

Target

AS.bin.dll
Size

6.1MB
MD5

3e83b87371048459516879706507bb81
SHA1

181823bd5aa2fa6b40d2e31634932eb6b3000a67
SHA256

e8d81e7b25128035e30e271708d66efaf12c490114042e1e493a0c816d374414
SHA512

36eaf72260e7e5e5abe328056f71d9035790a09e00a342b3077767b028dee32d42e7b0604f48639b9bcc51a18dbc22280df8a5ebfbe8d5f60c3c25a2a53946a5
SSDEEP

98304:DTgpwS4t7BDf+UH0DUUGeiWtbeS5vaMfhzGuTIAFBXsTfneuVnPI:sVwUGeFbeSNa+aZEB8LneuxI

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rundll32.exe

description pid process

Token: SeSystemtimePrivilege 1616 rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1536 wrote to memory of 1616	1536	rundll32.exe	rundll32.exe
PID 1536 wrote to memory of 1616	1536	rundll32.exe	rundll32.exe
PID 1536 wrote to memory of 1616	1536	rundll32.exe	rundll32.exe
PID 1536 wrote to memory of 1616	1536	rundll32.exe	rundll32.exe
PID 1536 wrote to memory of 1616	1536	rundll32.exe	rundll32.exe
PID 1536 wrote to memory of 1616	1536	rundll32.exe	rundll32.exe
PID 1536 wrote to memory of 1616	1536	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AS.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1536

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AS.bin.dll,#1
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads