27c1d590c82b7756fadbbba4f4d8e7ac4ef090fa88c8a37b01e82dddac569f50

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2023 16:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

92adfbe29d3ddd3afe816ca7e6f183bb.dll
Size

102KB
MD5

92adfbe29d3ddd3afe816ca7e6f183bb
SHA1

8e6868f4784fa663b11e7c2f17281e1aec48a84c
SHA256

27c1d590c82b7756fadbbba4f4d8e7ac4ef090fa88c8a37b01e82dddac569f50
SHA512

9a329727229d624241d14ab206219f2fad29125ec5fb2f1a332dd2832198382229eca03bdcf435563dcd3a121a8e96aa4648ea77704954a62bf4e88b6cdac68e
SSDEEP

3072:gWlRooD+MzxG2Mosm5quQR5yyrz7BUKBYW0Z:gc2l0RsIquQR5vdCW0Z

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 4988 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	4988	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2664 wrote to memory of 4580	2664	rundll32.exe	rundll32.exe
PID 2664 wrote to memory of 4580	2664	rundll32.exe	rundll32.exe
PID 2664 wrote to memory of 4580	2664	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92adfbe29d3ddd3afe816ca7e6f183bb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2664

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92adfbe29d3ddd3afe816ca7e6f183bb.dll,#1
2⤵
PID:4580

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2328

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm
Filesize
16KB

MD5
0c853493f2908acf5fb34d44ec23e3e9

SHA1
2919632f0ba1fe8d51fa3c7004f666b71763e689

SHA256
1739cc1da2effcc256005640bdcfc8b0e8c8f7580e5ff9424066cb2b2b99cca0

SHA512
09c5efa8d922a178d3d32f026e0a842716a7d972c67417abdffc7ae8aa057767bc609fbb277b5727a545a400b317b71e0e7b581db45369f765c344301a334728

Download Submit
memory/4988-40-0x0000014268BE0000-0x0000014268BE1000-memory.dmp

Filesize
4KB

Download
memory/4988-33-0x0000014268BE0000-0x0000014268BE1000-memory.dmp

Filesize
4KB

Download
memory/4988-42-0x0000014268BE0000-0x0000014268BE1000-memory.dmp

Filesize
4KB

Download
memory/4988-34-0x0000014268BE0000-0x0000014268BE1000-memory.dmp

Filesize
4KB

Download
memory/4988-35-0x0000014268BE0000-0x0000014268BE1000-memory.dmp

Filesize
4KB

Download
memory/4988-36-0x0000014268BE0000-0x0000014268BE1000-memory.dmp

Filesize
4KB

Download
memory/4988-37-0x0000014268BE0000-0x0000014268BE1000-memory.dmp

Filesize
4KB

Download
memory/4988-38-0x0000014268BE0000-0x0000014268BE1000-memory.dmp

Filesize
4KB

Download
memory/4988-43-0x0000014268800000-0x0000014268801000-memory.dmp

Filesize
4KB

Download
memory/4988-0-0x0000014260540000-0x0000014260550000-memory.dmp

Filesize
64KB

Download
memory/4988-68-0x0000014268A50000-0x0000014268A51000-memory.dmp

Filesize
4KB

Download
memory/4988-32-0x0000014268BB0000-0x0000014268BB1000-memory.dmp

Filesize
4KB

Download
memory/4988-39-0x0000014268BE0000-0x0000014268BE1000-memory.dmp

Filesize
4KB

Download
memory/4988-44-0x00000142687F0000-0x00000142687F1000-memory.dmp

Filesize
4KB

Download
memory/4988-46-0x0000014268800000-0x0000014268801000-memory.dmp

Filesize
4KB

Download
memory/4988-49-0x00000142687F0000-0x00000142687F1000-memory.dmp

Filesize
4KB

Download
memory/4988-52-0x000001425FFF0000-0x000001425FFF1000-memory.dmp

Filesize
4KB

Download
memory/4988-16-0x0000014260640000-0x0000014260650000-memory.dmp

Filesize
64KB

Download
memory/4988-64-0x0000014268930000-0x0000014268931000-memory.dmp

Filesize
4KB

Download
memory/4988-66-0x0000014268940000-0x0000014268941000-memory.dmp

Filesize
4KB

Download
memory/4988-67-0x0000014268940000-0x0000014268941000-memory.dmp

Filesize
4KB

Download
memory/4988-41-0x0000014268BE0000-0x0000014268BE1000-memory.dmp

Filesize
4KB

Download