909df004857e854a646328179d73a9738eec6b2eb559be3b0cd8d3c53b3dd29a | Triage

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 05:06

Sharing

Report Analysis Logs

General

Target

Dyn/ShellRepair.dll
Size

165KB
MD5

8ed1ee7e66658a900b099e99bffb5aed
SHA1

fb3249181fa54e5e8c75205e3b2bf441cc877302
SHA256

1ed7a749c38e0fd4d68551d3bbf4b17e9ec953e4b243a2c9cdd6af9c4ba194c9
SHA512

d99f9f4e79d03fc1632b2d39144433454a35f6cd8c22ed4aa39f308f714c4f73d1f8685155773c560af86c22c8e7886babd22c59279e18c6166ca364aa602cf7
SSDEEP

3072:3zLCaxNab7bhcZgmTgInL8CLy1Jflp8fmMJNlAeBhopznQ:jLCyMb/atXkf8fNlAeV

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3664	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 3664	1648	rundll32.exe	88
PID 1648 wrote to memory of 3664	1648	rundll32.exe	88
PID 1648 wrote to memory of 3664	1648	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dyn\ShellRepair.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dyn\ShellRepair.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads