Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-12-2023 17:56

General

  • Target

    19be843e1e7a222fde2fae8e0ae5845bdd145d2e0c8f2b2761934177d5166140.dll

  • Size

    1.7MB

  • MD5

    b7d203f9ccf9a98e27ab925098fb8a71

  • SHA1

    37b79bc448665c318320096df4806d2ac47c9f41

  • SHA256

    19be843e1e7a222fde2fae8e0ae5845bdd145d2e0c8f2b2761934177d5166140

  • SHA512

    1dd0d0639d7069e9c8c9d14de70e0e2f447e44fe970e2bb27c49dbe33c9e1c07901eae87212732c6ae5163c8bb6cc4fe4e77962fb32d4edbed6e8390d3a2a5f8

  • SSDEEP

    49152:Fy/cyumABfpGHemqrVf3ALr1x/wsL0h8OsWfS:M/cHmRHjqZcr1JBxbH

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\19be843e1e7a222fde2fae8e0ae5845bdd145d2e0c8f2b2761934177d5166140.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5104
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\19be843e1e7a222fde2fae8e0ae5845bdd145d2e0c8f2b2761934177d5166140.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:3552
  • C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
    1⤵
      PID:4668
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k UnistackSvcGroup
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3908

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

      Filesize

      16KB

      MD5

      3c362cbad4ae2a0275d39fe045fe7c7a

      SHA1

      7439e5eddd6f0714743dbf4fe8211cac54dc2dbb

      SHA256

      ab2d29f91f0987b0cfc3478614eeb5da7d2ed7db52effecff14ccfd369ea3167

      SHA512

      199c28a0232b47821a372bd457f0914e1be4ea7857325375dae925c5e21d2d44ed51cbe6deb76dff98eadae1d0669e61e8413ad2db730911f31f531245522d7d

    • memory/3552-0-0x00000000751B0000-0x0000000075789000-memory.dmp

      Filesize

      5.8MB

    • memory/3908-44-0x0000020894690000-0x0000020894691000-memory.dmp

      Filesize

      4KB

    • memory/3908-36-0x0000020894690000-0x0000020894691000-memory.dmp

      Filesize

      4KB

    • memory/3908-45-0x0000020894690000-0x0000020894691000-memory.dmp

      Filesize

      4KB

    • memory/3908-37-0x0000020894690000-0x0000020894691000-memory.dmp

      Filesize

      4KB

    • memory/3908-38-0x0000020894690000-0x0000020894691000-memory.dmp

      Filesize

      4KB

    • memory/3908-39-0x0000020894690000-0x0000020894691000-memory.dmp

      Filesize

      4KB

    • memory/3908-40-0x0000020894690000-0x0000020894691000-memory.dmp

      Filesize

      4KB

    • memory/3908-41-0x0000020894690000-0x0000020894691000-memory.dmp

      Filesize

      4KB

    • memory/3908-46-0x00000208942C0000-0x00000208942C1000-memory.dmp

      Filesize

      4KB

    • memory/3908-43-0x0000020894690000-0x0000020894691000-memory.dmp

      Filesize

      4KB

    • memory/3908-71-0x0000020894510000-0x0000020894511000-memory.dmp

      Filesize

      4KB

    • memory/3908-35-0x0000020894670000-0x0000020894671000-memory.dmp

      Filesize

      4KB

    • memory/3908-42-0x0000020894690000-0x0000020894691000-memory.dmp

      Filesize

      4KB

    • memory/3908-47-0x00000208942B0000-0x00000208942B1000-memory.dmp

      Filesize

      4KB

    • memory/3908-49-0x00000208942C0000-0x00000208942C1000-memory.dmp

      Filesize

      4KB

    • memory/3908-52-0x00000208942B0000-0x00000208942B1000-memory.dmp

      Filesize

      4KB

    • memory/3908-55-0x00000208941F0000-0x00000208941F1000-memory.dmp

      Filesize

      4KB

    • memory/3908-3-0x000002088BF80000-0x000002088BF90000-memory.dmp

      Filesize

      64KB

    • memory/3908-67-0x00000208943F0000-0x00000208943F1000-memory.dmp

      Filesize

      4KB

    • memory/3908-69-0x0000020894400000-0x0000020894401000-memory.dmp

      Filesize

      4KB

    • memory/3908-70-0x0000020894400000-0x0000020894401000-memory.dmp

      Filesize

      4KB

    • memory/3908-19-0x000002088C080000-0x000002088C090000-memory.dmp

      Filesize

      64KB