ff7706dad388652ba868408d8848872f1a19d0e6f1a730c31c88572af5faa8bf | Triage

Analysis

max time kernel
505s
max time network
508s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2023 09:47

Sharing

Report Analysis Logs

General

Target

Mono.Cecil.Pdb.dll
Size

87KB
MD5

6d5eb860c2be5dbeb470e7d3f3e7dda4
SHA1

80c76660b87c52127b1a7da48e27700f75362041
SHA256

447ede1984bb4acd73bd97c0ec57a11c079cee8301c91fb199ca98c1906d3cc4
SHA512

64cf4fe7de68a35720d2b9338ba9cf182e127d95d72d2ccf7ff5c73a368133663e70c988a460825fa87b2d03717a4447948d5262f56aceb7c3bf1cb3ab5a41a5
SSDEEP

1536:2OCAsdBo+am5OMwr5IlALYKXgAJGsZhTjrjvjCXeO:ZCjta0OMuIlArVJGqT/jveXeO

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{324AD7B6-A10A-4C3F-BB08-61752EE66170}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{2A2D3FFE-BE30-424A-978A-ADB8BD173B46}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{08C8826D-95DF-4C03-A613-CC79D77F3CAC}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{8485335F-EEA2-479E-A451-1755A7EC30AE}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{5675B3EB-A2A5-4751-96E0-B87A5D9FAA63}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{307F9E2E-32A0-4819-9A9A-E2CBC88044F1}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{0F63E324-80A6-44B4-9E49-2A4622436EA3}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{EA254DAB-76C4-4ADA-A29F-257FBA5F3B46}.catalogItem	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Mono.Cecil.Pdb.dll,#1
1⤵
PID:4760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:4780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads