cbe204430259846c4931bc787d52efcc8069492e43f21895775e4f006b50024a

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
15/11/2023, 10:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cbe204430259846c4931bc787d52efcc8069492e43f21895775e4f006b50024a.dll
Size

1.0MB
MD5

6b412fa527f67d8aa932077815040485
SHA1

506947dc3ed75e99d763ee21181680f84fc956c3
SHA256

cbe204430259846c4931bc787d52efcc8069492e43f21895775e4f006b50024a
SHA512

eec48c1906b84d3a38b3aebaa37c4ab0b7a8c4696af9b815f8c13b8c3915dc59687afbb28ef88656e2f2ee4ac0af48b3aa27248acd26b000f26f29826b77f5a4
SSDEEP

24576:wprBKEy/IBkoECXwVVBdDlz1DFVox4b8D:bEyABhChDV1DFVo7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
964	4872	WerFault.exe	85

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	2024	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4872	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 4872	2072	rundll32.exe	85
PID 2072 wrote to memory of 4872	2072	rundll32.exe	85
PID 2072 wrote to memory of 4872	2072	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbe204430259846c4931bc787d52efcc8069492e43f21895775e4f006b50024a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbe204430259846c4931bc787d52efcc8069492e43f21895775e4f006b50024a.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 744
    3⤵
    - Program crash
    PID:964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4872 -ip 4872
1⤵
PID:2996

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:524

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
108cea56fb89026e0b54cb16da239537

SHA1
183cf76f1c9b1da9febb19218073b66ea6ec6ce3

SHA256
aa35ca27f0e537aa9826638e621a8b2500e74dc85470a68effc44e4f58e569c0

SHA512
2dd841bc52a31780755fb4d4977a5296bd7d80f3b881fe345ab7c8cd695a1cd6320eb4f57035af69792212862e428a29d01e5e4936ec4a13641debd763dcb85c

Download Submit
memory/2024-42-0x0000017B55310000-0x0000017B55311000-memory.dmp

Filesize
4KB

Download
memory/2024-43-0x0000017B55310000-0x0000017B55311000-memory.dmp

Filesize
4KB

Download
memory/2024-18-0x0000017B4CD40000-0x0000017B4CD50000-memory.dmp

Filesize
64KB

Download
memory/2024-34-0x0000017B55300000-0x0000017B55301000-memory.dmp

Filesize
4KB

Download
memory/2024-35-0x0000017B55310000-0x0000017B55311000-memory.dmp

Filesize
4KB

Download
memory/2024-36-0x0000017B55310000-0x0000017B55311000-memory.dmp

Filesize
4KB

Download
memory/2024-70-0x0000017B551A0000-0x0000017B551A1000-memory.dmp

Filesize
4KB

Download
memory/2024-38-0x0000017B55310000-0x0000017B55311000-memory.dmp

Filesize
4KB

Download
memory/2024-39-0x0000017B55310000-0x0000017B55311000-memory.dmp

Filesize
4KB

Download
memory/2024-40-0x0000017B55310000-0x0000017B55311000-memory.dmp

Filesize
4KB

Download
memory/2024-2-0x0000017B4CC40000-0x0000017B4CC50000-memory.dmp

Filesize
64KB

Download
memory/2024-37-0x0000017B55310000-0x0000017B55311000-memory.dmp

Filesize
4KB

Download
memory/2024-48-0x0000017B54F50000-0x0000017B54F51000-memory.dmp

Filesize
4KB

Download
memory/2024-44-0x0000017B55310000-0x0000017B55311000-memory.dmp

Filesize
4KB

Download
memory/2024-45-0x0000017B54F50000-0x0000017B54F51000-memory.dmp

Filesize
4KB

Download
memory/2024-46-0x0000017B54F40000-0x0000017B54F41000-memory.dmp

Filesize
4KB

Download
memory/2024-41-0x0000017B55310000-0x0000017B55311000-memory.dmp

Filesize
4KB

Download
memory/2024-51-0x0000017B54F40000-0x0000017B54F41000-memory.dmp

Filesize
4KB

Download
memory/2024-54-0x0000017B54E80000-0x0000017B54E81000-memory.dmp

Filesize
4KB

Download
memory/2024-69-0x0000017B55090000-0x0000017B55091000-memory.dmp

Filesize
4KB

Download
memory/2024-66-0x0000017B55080000-0x0000017B55081000-memory.dmp

Filesize
4KB

Download
memory/2024-68-0x0000017B55090000-0x0000017B55091000-memory.dmp

Filesize
4KB

Download
memory/4872-1-0x0000000010000000-0x000000001013D000-memory.dmp

Filesize
1.2MB

Download
memory/4872-0-0x0000000010000000-0x000000001013D000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads