1a6a8fa07f09f39e9cbdb70ae570bf3eae6eaa464278e6b9ef1d34d378de077c | Triage

Analysis

max time kernel
139s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 20:05

Sharing

Report Analysis Logs

General

Target

90086cdb26ea418d34b595ee36943e1f.dll
Size

40KB
MD5

90086cdb26ea418d34b595ee36943e1f
SHA1

2a099fe9cf634a39774b601c7902ce9b4f8fd8be
SHA256

1a6a8fa07f09f39e9cbdb70ae570bf3eae6eaa464278e6b9ef1d34d378de077c
SHA512

8212db3c17163a3b37855099952018f0b06996031e1d5adb0a36d685a39241af71c0b823b5e098d01d72f86865cd1f978a5d76d4b0a3812d3865313ad7a9d1ba
SSDEEP

768:Ky6Ad3Rmv6i8wUqzX8NAm/YylP9s6Vprmit6Hgor:KRAD2YSs5/DlP9Pi26Hn

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1948	rundll32.exe
Token: SeDebugPrivilege	1948	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 1948	2176	rundll32.exe	84
PID 2176 wrote to memory of 1948	2176	rundll32.exe	84
PID 2176 wrote to memory of 1948	2176	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\90086cdb26ea418d34b595ee36943e1f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\90086cdb26ea418d34b595ee36943e1f.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1948-2-0x0000000076F02000-0x0000000076F03000-memory.dmp

Filesize
4KB

Download
memory/1948-3-0x0000000076F02000-0x0000000076F03000-memory.dmp

Filesize
4KB

Download
memory/1948-4-0x0000000000F90000-0x0000000000FA0000-memory.dmp

Filesize
64KB

Download