b24c9fc802903c5d0b194a118d05f123f550e6ea296c886f1c326fdf3e012689 | Triage

Analysis

max time kernel
118s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 07:45

Sharing

Report Analysis Logs

General

Target

127e5262450e7be8f12621826840d0b6.dll
Size

13KB
MD5

127e5262450e7be8f12621826840d0b6
SHA1

48b1779c09599395b957609b01b68e3d1e697f1e
SHA256

b24c9fc802903c5d0b194a118d05f123f550e6ea296c886f1c326fdf3e012689
SHA512

c98270677960f7519f9770283f8fd3e35e3dd3dacf00cf119ceffde8144bf23d8127d0668e0188ccac0302f612ee7400e812b593c4a3e5ccd146832ea115a8ca
SSDEEP

384:Mv8jpdemtuGVAJMwAhWz4tG6rYzWBT0EWbNj:e3mULbAhWctiBNj

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Win.ini	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeBackupPrivilege	2948	rundll32.exe
Token: SeRestorePrivilege	2948	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 2948	1236	rundll32.exe	28
PID 1236 wrote to memory of 2948	1236	rundll32.exe	28
PID 1236 wrote to memory of 2948	1236	rundll32.exe	28
PID 1236 wrote to memory of 2948	1236	rundll32.exe	28
PID 1236 wrote to memory of 2948	1236	rundll32.exe	28
PID 1236 wrote to memory of 2948	1236	rundll32.exe	28
PID 1236 wrote to memory of 2948	1236	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\127e5262450e7be8f12621826840d0b6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\127e5262450e7be8f12621826840d0b6.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:2948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads