Analysis
- max time kernel
142s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
02/10/2023, 23:18
General
- Target 1672-970-0x0000000003690000-0x00000000037C1000-memory.dll
- Size 1.2MB
- Sample231002-299b7sgh99
- SHA256 342fbfdd7e4170b0b2fcc08ca9986a135c577162295aec86f157dfb48d01f0a5
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1672-970-0x0000000003690000-0x00000000037C1000-memory.dll,#11⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1232-0-0x0000028F3C560000-0x0000028F3C570000-memory.dmp
memory/1232-16-0x0000028F3C660000-0x0000028F3C670000-memory.dmp
memory/1232-32-0x0000028F449D0000-0x0000028F449D1000-memory.dmp
memory/1232-34-0x0000028F44A00000-0x0000028F44A01000-memory.dmp
memory/1232-35-0x0000028F44A00000-0x0000028F44A01000-memory.dmp
memory/1232-36-0x0000028F44B10000-0x0000028F44B11000-memory.dmp