Analysis
- max time kernel
93s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
29/02/2024, 16:14
General
- Target aeef0e850a364f8794133dc64717850b.dll
- Size 615KB
- Sample240229-tpr87aee59
- SHA256 462ab9c3edb1bc0477593a3033de602880b6b70794cc0d143e39387189b77d66
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\aeef0e850a364f8794133dc64717850b.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\aeef0e850a364f8794133dc64717850b.dll,#12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 6643⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2740 -ip 27401⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2740-0-0x0000000002340000-0x0000000002442000-memory.dmp
memory/2740-1-0x0000000002340000-0x0000000002442000-memory.dmp
memory/2740-2-0x0000000002630000-0x0000000002631000-memory.dmp
memory/2740-3-0x00000000005D0000-0x00000000005D1000-memory.dmp
memory/2740-4-0x00000000005B0000-0x00000000005B1000-memory.dmp
memory/2740-6-0x0000000002690000-0x0000000002693000-memory.dmp
memory/2740-5-0x0000000002650000-0x0000000002651000-memory.dmp
memory/2740-7-0x00000000026A0000-0x00000000026A1000-memory.dmp
memory/2740-8-0x0000000002660000-0x0000000002661000-memory.dmp
memory/2740-9-0x0000000002670000-0x0000000002671000-memory.dmp
memory/2740-10-0x00000000026D0000-0x00000000026D1000-memory.dmp
memory/2740-12-0x00000000026B0000-0x00000000026B1000-memory.dmp
memory/2740-11-0x00000000026C0000-0x00000000026C1000-memory.dmp
memory/2740-13-0x00000000024B0000-0x00000000024F3000-memory.dmp
memory/2740-14-0x0000000002680000-0x0000000002681000-memory.dmp
memory/2740-15-0x0000000002D60000-0x0000000002D61000-memory.dmp
memory/2740-16-0x0000000002710000-0x0000000002711000-memory.dmp
memory/2740-17-0x0000000002700000-0x0000000002701000-memory.dmp
memory/2740-18-0x0000000002340000-0x0000000002442000-memory.dmp
memory/2740-19-0x0000000002700000-0x0000000002701000-memory.dmp