13b1905df941b9cb19b679cd699a36464c8c419d8ad5ba4df1c7b82cad40278e | Triage

Analysis

max time kernel
94s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 08:53

Sharing

Report Analysis Logs

General

Target

133e0cd763163f52398181c327308062.dll
Size

150KB
MD5

133e0cd763163f52398181c327308062
SHA1

59402c90a6b2af1080faeaa1f92558f9d87839f2
SHA256

13b1905df941b9cb19b679cd699a36464c8c419d8ad5ba4df1c7b82cad40278e
SHA512

dd8ec79cadea3dfae11d679d7855a4b61b2eb902d06e6dd3648a21d0f2fcae83b26fd0946fb623c766fa1e82f7b965ba9a4c08273e000763f1e76a545a8ab518
SSDEEP

3072:TTWDGeQbILS00wgTQhkLGhBvg7WFdyR5vt2mG6:TTqjL4ijBjmT

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	1168	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1168	rundll32.exe
1168	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1168	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 1168	4536	rundll32.exe	14
PID 4536 wrote to memory of 1168	4536	rundll32.exe	14
PID 4536 wrote to memory of 1168	4536	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\133e0cd763163f52398181c327308062.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1168

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\133e0cd763163f52398181c327308062.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1168-2-0x0000000000A10000-0x0000000000B10000-memory.dmp

Filesize
1024KB

Download
memory/1168-1-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download