0f37bd27524f5f3bee0687b12da291243944acd88cc87fde1d5fab7aa8e769a0 | Triage

Analysis

max time kernel
138s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15/01/2024, 02:31

Sharing

Report Analysis Logs

General

Target

5be6bb46f339d84a5075495627ec6558.dll
Size

12KB
MD5

5be6bb46f339d84a5075495627ec6558
SHA1

b96d6564b4faaaa6eb766796a2cbb41cb4972469
SHA256

0f37bd27524f5f3bee0687b12da291243944acd88cc87fde1d5fab7aa8e769a0
SHA512

a126a45661a9809898240651884ed6915ea33220b49ab8233352fe550d76673807864ce537cd112ca171ed906b455bb176ab635a9554511fbbe2af39b6b99567
SSDEEP

384:pxyCET1a6n/6+W/Ia30aapYdzp5n71Hnsl8U:7ax/zW/IaB8YdzpJBe

Score

1^/10

Malware Config

Signatures

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
664	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3516	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3516	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3516	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 444 wrote to memory of 3516	444	rundll32.exe	84
PID 444 wrote to memory of 3516	444	rundll32.exe	84
PID 444 wrote to memory of 3516	444	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5be6bb46f339d84a5075495627ec6558.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5be6bb46f339d84a5075495627ec6558.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:3516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3516-0-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download