774dedd605c111baf313ee81be57f35ed76499281450a931e10fe9617fe81e73 | Triage

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 14:44

Sharing

Report Analysis Logs

General

Target

269e4e605ee34f0bb6e149bf952bce27.dll
Size

32KB
MD5

269e4e605ee34f0bb6e149bf952bce27
SHA1

64653741341e9d46091f5840af77203b6f1ca3c8
SHA256

774dedd605c111baf313ee81be57f35ed76499281450a931e10fe9617fe81e73
SHA512

6afef143032bc46a8d8bc040cd19c871305bf88e84ec51d83b762837a08d5ddc914ce772e3c27d3bc40356658470a08e918887dd64c994fa8dbce6dd68adb304
SSDEEP

768:upCmoi6qZOpQB5ZpOc06HCMH/sJ2Fvu7s9C84ZZ:ugmv6qZ4QxpP0AtH0J6O

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2956	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2956	2852	rundll32.exe	28
PID 2852 wrote to memory of 2956	2852	rundll32.exe	28
PID 2852 wrote to memory of 2956	2852	rundll32.exe	28
PID 2852 wrote to memory of 2956	2852	rundll32.exe	28
PID 2852 wrote to memory of 2956	2852	rundll32.exe	28
PID 2852 wrote to memory of 2956	2852	rundll32.exe	28
PID 2852 wrote to memory of 2956	2852	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\269e4e605ee34f0bb6e149bf952bce27.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\269e4e605ee34f0bb6e149bf952bce27.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2956-0-0x0000000000160000-0x000000000016E000-memory.dmp

Filesize
56KB

Download
memory/2956-2-0x0000000074E80000-0x0000000074F0D000-memory.dmp

Filesize
564KB

Download
memory/2956-1-0x00000000765C0000-0x00000000766B0000-memory.dmp

Filesize
960KB

Download