8e6939f8255b76875f4fa4a4b88f5ee956d28930724369d5c004dbd2cbe84d87 | Triage

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 18:49

Sharing

Report Analysis Logs

General

Target

$_54_/Engine.dll
Size

505KB
MD5

9591c007306d16905bb4c8d7682cd3f6
SHA1

e0512c66ebe9c22f782ab26e816cdbce4b4faf68
SHA256

39827afbbbba8ff453b63e0e94727205654cd2125e84a9b6999982ed06f69893
SHA512

50c24181aaa352ee88667d5838822d3dd99a5637fc2e084282a1354c39021069e671edc96b39cd055bafc57a0d7777a177da637733ba626a42474e495231924e
SSDEEP

12288:BeptOQvOSB/tpjbdAWFqNQTJBSHniXwvQ:YjOSBtdbdRN9BhXwY

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3136	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 3136	1532	rundll32.exe	14
PID 1532 wrote to memory of 3136	1532	rundll32.exe	14
PID 1532 wrote to memory of 3136	1532	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\Engine.dll,#1
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3136

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\Engine.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3136-0-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download