a148412a5c1cc9aba0ecdbb3e44010aeac75b40f23492bd04c0127e558aa44ac

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 04:31

Target
[email protected]/components/OfferBoxXpCom.dll
Size 94KB
Sample240118-e5vlxscgbk
SHA256 fa5fa9ee65b61c98d74810d5825ca37ff9e37d8ae50fcbccf0bab42eac0cde12
MD5 2e619bbb0c7d078b79be4ea94b8f9c31
SHA1 a72aab4defe54d679c5815e99ca5138f1487671f
SHA512 234c7ee91f69db64e6b32913232b9ad4b75f1da64377391444ce5b12fa93b3eec7b977397f6c61acd36cb67e09876ff40105c1ed2bce610308a83dce49448cc3
SSDEEP 1536:9iC0px/QM6k3lFX5zf2R4gV2flkhSJyJmq2fBRI5mb6lpatyCNs:On4pkjQR4fI4qGBi5mOl0tbs
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	2560	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 5068	1960	rundll32.exe	59
PID 1960 wrote to memory of 5068	1960	rundll32.exe	59
PID 1960 wrote to memory of 5068	1960	rundll32.exe	59

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\[email protected]\components\OfferBoxXpCom.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\[email protected]\components\OfferBoxXpCom.dll,#1
  2⤵
  PID:5068

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:624

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2560

memory/2560-16-0x000001B071A40000-0x000001B071A50000-memory.dmp

Download

memory/2560-0-0x000001B071940000-0x000001B071950000-memory.dmp

Download

memory/2560-36-0x000001B079EA0000-0x000001B079EA1000-memory.dmp

Download

memory/2560-35-0x000001B079D90000-0x000001B079D91000-memory.dmp

Download

memory/2560-34-0x000001B079D90000-0x000001B079D91000-memory.dmp

Download

memory/2560-32-0x000001B079D60000-0x000001B079D61000-memory.dmp

Download