Analysis
- max time kernel
136s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20231023-en - resource tags
- submitted
20/11/2023, 00:12
General
- Target 34e890c28a527694612fdc10a81b957cef73ab3e139408088f5c054d5fc04a6b.dll
- Size 51KB
- Sample231120-ag8fnach72
- SHA256 34e890c28a527694612fdc10a81b957cef73ab3e139408088f5c054d5fc04a6b
Score
1/10
Malware Config
Signatures
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\34e890c28a527694612fdc10a81b957cef73ab3e139408088f5c054d5fc04a6b.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\34e890c28a527694612fdc10a81b957cef73ab3e139408088f5c054d5fc04a6b.dll,#12⤵
- Suspicious behavior: RenamesItself
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/660-0-0x0000022B43260000-0x0000022B43270000-memory.dmp
memory/660-16-0x0000022B43360000-0x0000022B43370000-memory.dmp
memory/660-32-0x0000022B4B6D0000-0x0000022B4B6D1000-memory.dmp
memory/660-34-0x0000022B4B700000-0x0000022B4B701000-memory.dmp
memory/660-35-0x0000022B4B700000-0x0000022B4B701000-memory.dmp
memory/660-36-0x0000022B4B810000-0x0000022B4B811000-memory.dmp