909df004857e854a646328179d73a9738eec6b2eb559be3b0cd8d3c53b3dd29a | Triage

Analysis

max time kernel
119s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-03-2024 05:06

Sharing

Report Analysis Logs

General

Target

Dyn/ShellRepair.dll
Size

165KB
MD5

8ed1ee7e66658a900b099e99bffb5aed
SHA1

fb3249181fa54e5e8c75205e3b2bf441cc877302
SHA256

1ed7a749c38e0fd4d68551d3bbf4b17e9ec953e4b243a2c9cdd6af9c4ba194c9
SHA512

d99f9f4e79d03fc1632b2d39144433454a35f6cd8c22ed4aa39f308f714c4f73d1f8685155773c560af86c22c8e7886babd22c59279e18c6166ca364aa602cf7
SSDEEP

3072:3zLCaxNab7bhcZgmTgInL8CLy1Jflp8fmMJNlAeBhopznQ:jLCyMb/atXkf8fNlAeV

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3056	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 3056	1912	rundll32.exe	28
PID 1912 wrote to memory of 3056	1912	rundll32.exe	28
PID 1912 wrote to memory of 3056	1912	rundll32.exe	28
PID 1912 wrote to memory of 3056	1912	rundll32.exe	28
PID 1912 wrote to memory of 3056	1912	rundll32.exe	28
PID 1912 wrote to memory of 3056	1912	rundll32.exe	28
PID 1912 wrote to memory of 3056	1912	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dyn\ShellRepair.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dyn\ShellRepair.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads