96ca4cc3d47e4c189a8afd8e8ae5d20a3c489adb741576b68d837293f4522f3e

Analysis

max time kernel
127s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2023, 13:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

407eb23a1b18efa17c38e9c0d914306c145a2b77b562d4e1077a823190434369.dll
Size

280KB
MD5

e6a0cdb2c255813cc02c9fa97cf4ea33
SHA1

8c44cb17b7c726d4afc959bf6654db2b7610032a
SHA256

407eb23a1b18efa17c38e9c0d914306c145a2b77b562d4e1077a823190434369
SHA512

e72382e31aa7d8413b1a81d8f85ff6df258129dfc9469384aae699fae0a5e85f39310cb60be1ab5219c387f8026a583c8303ac5514b93f6ffac277e77a27073a
SSDEEP

6144:LtEa0+E8w405ezNaJh4VqaDMWOFcnWA7Hab1PTustA771oBFmuY:f0tne0GqaDwKnWYuY

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3868 set thread context of 4856	3868	rundll32.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4856	WWAHost.exe
4856	WWAHost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3868	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4856	WWAHost.exe
Token: SeManageVolumePrivilege	2324	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 4856	3868	rundll32.exe	85
PID 3868 wrote to memory of 4856	3868	rundll32.exe	85
PID 3868 wrote to memory of 4856	3868	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\407eb23a1b18efa17c38e9c0d914306c145a2b77b562d4e1077a823190434369.dll,#1
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Windows\system32\WWAHost.exe
  C:\Windows\system32\WWAHost.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4856

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2324-63-0x000001C71C680000-0x000001C71C681000-memory.dmp

Filesize
4KB

Download
memory/2324-62-0x000001C71C570000-0x000001C71C571000-memory.dmp

Filesize
4KB

Download
memory/2324-61-0x000001C71C570000-0x000001C71C571000-memory.dmp

Filesize
4KB

Download
memory/2324-59-0x000001C71C540000-0x000001C71C541000-memory.dmp

Filesize
4KB

Download
memory/2324-43-0x000001C714240000-0x000001C714250000-memory.dmp

Filesize
64KB

Download
memory/2324-27-0x000001C714140000-0x000001C714150000-memory.dmp

Filesize
64KB

Download
memory/3868-0-0x00007FFE641D0000-0x00007FFE643C5000-memory.dmp

Filesize
2.0MB

Download
memory/3868-1-0x00007FFE640D0000-0x00007FFE6418E000-memory.dmp

Filesize
760KB

Download
memory/4856-17-0x0000022EEF270000-0x0000022EEF280000-memory.dmp

Filesize
64KB

Download
memory/4856-26-0x0000022EEF270000-0x0000022EEF280000-memory.dmp

Filesize
64KB

Download
memory/4856-14-0x0000022ED4F10000-0x0000022ED4F50000-memory.dmp

Filesize
256KB

Download
memory/4856-18-0x0000022ED4FC0000-0x0000022ED4FC6000-memory.dmp

Filesize
24KB

Download
memory/4856-23-0x00007FFE464B0000-0x00007FFE46F71000-memory.dmp

Filesize
10.8MB

Download
memory/4856-25-0x0000022EEF270000-0x0000022EEF280000-memory.dmp

Filesize
64KB

Download
memory/4856-24-0x0000022EEF270000-0x0000022EEF280000-memory.dmp

Filesize
64KB

Download
memory/4856-16-0x0000022EEF270000-0x0000022EEF280000-memory.dmp

Filesize
64KB

Download
memory/4856-15-0x0000022EEF270000-0x0000022EEF280000-memory.dmp

Filesize
64KB

Download
memory/4856-13-0x00007FFE464B0000-0x00007FFE46F71000-memory.dmp

Filesize
10.8MB

Download
memory/4856-7-0x0000000180000000-0x0000000180041000-memory.dmp

Filesize
260KB

Download
memory/4856-4-0x00007FFE640D0000-0x00007FFE6418E000-memory.dmp

Filesize
760KB

Download
memory/4856-3-0x00007FFE641D0000-0x00007FFE643C5000-memory.dmp

Filesize
2.0MB

Download
memory/4856-2-0x0000022ED48A0000-0x0000022ED48E2000-memory.dmp

Filesize
264KB

Download