Analysis
-
max time kernel
1771s -
max time network
1160s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
11-02-2024 15:36
General
-
Target
x86/plugins/Updater.dll
-
Size
94KB
-
MD5
0d69dbdafe0a75066405c10413c7eb7b
-
SHA1
df685b3cc0bff48424c52b18aca90e128ab531b9
-
SHA256
badaddeeef941610eb0912330848349a08fcac0983d7fb749c45f70b86c59c7c
-
SHA512
57523899f4666324c6df7c2ac04d30d8e33cd8a5e5353552219ce6879c5a410b562f0dfaf696161f31d4d446d4cb3acf695d508d578d9a97f5b90e2466493eb9
-
SSDEEP
1536:ZXRrbgI85UI2SgY5qvE5R4zAijcPLsW+ycdgTsGb+nBMWz6TKMI9kj+tN5Ka:RR/Y5q6G1QPqgTsGb+nBMc6TKMI9i+tx
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\plugins\Updater.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\plugins\Updater.dll,#12⤵
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB