Analysis
- max time kernel
142s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
06/10/2023, 09:09
General
- Target 05c72e77d14cee079ac94706759dfe77c27fe51731a1eca22b03352190087e9e.dll
- Size 403KB
- Sample231006-k4yj3sac71
- SHA256 05c72e77d14cee079ac94706759dfe77c27fe51731a1eca22b03352190087e9e
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05c72e77d14cee079ac94706759dfe77c27fe51731a1eca22b03352190087e9e.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05c72e77d14cee079ac94706759dfe77c27fe51731a1eca22b03352190087e9e.dll,#12⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 10683⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2996 -ip 29961⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3372-2-0x00000262A9D40000-0x00000262A9D50000-memory.dmp
memory/3372-18-0x00000262A9E40000-0x00000262A9E50000-memory.dmp
memory/3372-34-0x00000262B2130000-0x00000262B2131000-memory.dmp
memory/3372-36-0x00000262B2160000-0x00000262B2161000-memory.dmp
memory/3372-37-0x00000262B2160000-0x00000262B2161000-memory.dmp
memory/3372-38-0x00000262B2270000-0x00000262B2271000-memory.dmp