Analysis
-
max time kernel
137s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2023, 21:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aeaecc4fa8944743ac80653c88c72b30_JC.dll
Resource
win7-20230831-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
aeaecc4fa8944743ac80653c88c72b30_JC.dll
Resource
win10v2004-20230915-en
1 signatures
150 seconds
General
-
Target
aeaecc4fa8944743ac80653c88c72b30_JC.dll
-
Size
9KB
-
MD5
aeaecc4fa8944743ac80653c88c72b30
-
SHA1
2402ada592b4834450f099542a85447560494cbf
-
SHA256
0f33942281317761f0ee6b0c84f6e66cbe239880cddd1801228aaebacd33c243
-
SHA512
acb07448af973f42a61b8d2d4c0c11457f600c8fe404482d45f6cd29692483cc1ff8d6949994b66476417c6a3ba56ebcee3486093b0da06bf5ef4a27618fb40c
-
SSDEEP
192:+EQ4G7Ci+qyyksJk1Al6KAmjH2wzJ7GH4:+E5G7nfyy7kMJV5o4
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeManageVolumePrivilege 1896 svchost.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\aeaecc4fa8944743ac80653c88c72b30_JC.dll,#11⤵PID:2500
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:2820
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1896