Analysis
- max time kernel
142s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
01/08/2023, 17:44
General
- Target 2236-57-0x000007FEF4EF0000-0x000007FEF5979000-memory.dll
- Size 10.5MB
- Sample230801-wbas4abc6v
- SHA256 e301211387dd926b857cda487945640eaa0fd5f5bfe270ffdfece98c9e291a09
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2236-57-0x000007FEF4EF0000-0x000007FEF5979000-memory.dll,#11⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4500-133-0x000002449B140000-0x000002449B150000-memory.dmp
memory/4500-149-0x000002449B240000-0x000002449B250000-memory.dmp
memory/4500-165-0x00000244A35A0000-0x00000244A35A1000-memory.dmp
memory/4500-167-0x00000244A35D0000-0x00000244A35D1000-memory.dmp
memory/4500-168-0x00000244A35D0000-0x00000244A35D1000-memory.dmp
memory/4500-169-0x00000244A36E0000-0x00000244A36E1000-memory.dmp