0f37bd27524f5f3bee0687b12da291243944acd88cc87fde1d5fab7aa8e769a0 | Triage

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
15/01/2024, 02:31

Sharing

Report Analysis Logs

General

Target

5be6bb46f339d84a5075495627ec6558.dll
Size

12KB
MD5

5be6bb46f339d84a5075495627ec6558
SHA1

b96d6564b4faaaa6eb766796a2cbb41cb4972469
SHA256

0f37bd27524f5f3bee0687b12da291243944acd88cc87fde1d5fab7aa8e769a0
SHA512

a126a45661a9809898240651884ed6915ea33220b49ab8233352fe550d76673807864ce537cd112ca171ed906b455bb176ab635a9554511fbbe2af39b6b99567
SSDEEP

384:pxyCET1a6n/6+W/Ia30aapYdzp5n71Hnsl8U:7ax/zW/IaB8YdzpJBe

Score

1^/10

Malware Config

Signatures

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
480	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2424	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2424	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2424	3016	rundll32.exe	14
PID 3016 wrote to memory of 2424	3016	rundll32.exe	14
PID 3016 wrote to memory of 2424	3016	rundll32.exe	14
PID 3016 wrote to memory of 2424	3016	rundll32.exe	14
PID 3016 wrote to memory of 2424	3016	rundll32.exe	14
PID 3016 wrote to memory of 2424	3016	rundll32.exe	14
PID 3016 wrote to memory of 2424	3016	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5be6bb46f339d84a5075495627ec6558.dll,#1
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2424

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5be6bb46f339d84a5075495627ec6558.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2424-1-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/2424-0-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download