2cb1bdaa061b9cd1d8f761f9b06323783cd57e517900773b6d2807ed7a8460c4

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
15/11/2023, 19:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2cb1bdaa061b9cd1d8f761f9b06323783cd57e517900773b6d2807ed7a8460c4.dll
Size

899KB
MD5

d08689b640e526892cc39246f8fd4215
SHA1

b7172d0b2bdfc26638d14531a229de83168baa54
SHA256

2cb1bdaa061b9cd1d8f761f9b06323783cd57e517900773b6d2807ed7a8460c4
SHA512

4e6566c41c2950b15f4eedbd438bc9961daca23b99b47ca0c448b78d88ee6ed50cab31b71110dace5cf96e5c26235b0b694ac1fe0d10be2fdefb6883781c9cbb
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX2:7wqd87V2

Score

1^/10

Malware Config

Signatures

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4764	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	3016	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 4764	2604	rundll32.exe	83
PID 2604 wrote to memory of 4764	2604	rundll32.exe	83
PID 2604 wrote to memory of 4764	2604	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cb1bdaa061b9cd1d8f761f9b06323783cd57e517900773b6d2807ed7a8460c4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cb1bdaa061b9cd1d8f761f9b06323783cd57e517900773b6d2807ed7a8460c4.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4764

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:5068

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
da03d212006979af19ea29fb2ee5c1b7

SHA1
41dea52c1c3ee4169a0b3b02ba2eb5d66404e516

SHA256
591f558604b63c352ae388ef9cae58ee032e7a6ec628c23e0a68875ed97b8c65

SHA512
f19af63eb9d4c4f1bd3b303842b10cb13127e2608aef1959bb8b44fc10be4485f1e4e9b776a6aa4d24432b045f577271b70d6f15cdc2a507e341e7b52f9c9e25

Download Submit
memory/3016-40-0x00000233E8250000-0x00000233E8251000-memory.dmp

Filesize
4KB

Download
memory/3016-42-0x00000233E8250000-0x00000233E8251000-memory.dmp

Filesize
4KB

Download
memory/3016-33-0x00000233E8250000-0x00000233E8251000-memory.dmp

Filesize
4KB

Download
memory/3016-34-0x00000233E8250000-0x00000233E8251000-memory.dmp

Filesize
4KB

Download
memory/3016-35-0x00000233E8250000-0x00000233E8251000-memory.dmp

Filesize
4KB

Download
memory/3016-36-0x00000233E8250000-0x00000233E8251000-memory.dmp

Filesize
4KB

Download
memory/3016-37-0x00000233E8250000-0x00000233E8251000-memory.dmp

Filesize
4KB

Download
memory/3016-38-0x00000233E8250000-0x00000233E8251000-memory.dmp

Filesize
4KB

Download
memory/3016-39-0x00000233E8250000-0x00000233E8251000-memory.dmp

Filesize
4KB

Download
memory/3016-44-0x00000233E7E60000-0x00000233E7E61000-memory.dmp

Filesize
4KB

Download
memory/3016-32-0x00000233E8220000-0x00000233E8221000-memory.dmp

Filesize
4KB

Download
memory/3016-41-0x00000233E8250000-0x00000233E8251000-memory.dmp

Filesize
4KB

Download
memory/3016-0-0x00000233DFB40000-0x00000233DFB50000-memory.dmp

Filesize
64KB

Download
memory/3016-43-0x00000233E7E70000-0x00000233E7E71000-memory.dmp

Filesize
4KB

Download
memory/3016-46-0x00000233E7E70000-0x00000233E7E71000-memory.dmp

Filesize
4KB

Download
memory/3016-49-0x00000233E7E60000-0x00000233E7E61000-memory.dmp

Filesize
4KB

Download
memory/3016-52-0x00000233E7DA0000-0x00000233E7DA1000-memory.dmp

Filesize
4KB

Download
memory/3016-16-0x00000233DFC40000-0x00000233DFC50000-memory.dmp

Filesize
64KB

Download
memory/3016-64-0x00000233E7FA0000-0x00000233E7FA1000-memory.dmp

Filesize
4KB

Download
memory/3016-66-0x00000233E7FB0000-0x00000233E7FB1000-memory.dmp

Filesize
4KB

Download
memory/3016-67-0x00000233E7FB0000-0x00000233E7FB1000-memory.dmp

Filesize
4KB

Download
memory/3016-68-0x00000233E80C0000-0x00000233E80C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads