0ce2b51563d55d5d3b6cc3e46a29ea479578dd6812fcac6933144163a8435fc2 | Triage

Analysis

max time kernel
92s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2024 07:27

Sharing

Report Analysis Logs

General

Target

cad4c91ffee634600361faf22b64e36e.dll
Size

100KB
MD5

cad4c91ffee634600361faf22b64e36e
SHA1

80753b3e220dd3dd73a3eb4acb09656c4f2204b6
SHA256

0ce2b51563d55d5d3b6cc3e46a29ea479578dd6812fcac6933144163a8435fc2
SHA512

1eabb58876868d72fbe97bfc2d1847536285e677f2f699f9e2f0e6c03eed326a8d82e14b9470109c4e9e53a14de6a17059dc0ce869ecd4805be359b43596e55e
SSDEEP

3072:wSuk/ep2355IFadqR6Nn1TuBOONJ2l0Q/lOlOJx:wtka235iRE1KOONJ2lB/

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2328	rundll32.exe
Token: SeSecurityPrivilege	2328	rundll32.exe
Token: SeTakeOwnershipPrivilege	2328	rundll32.exe
Token: SeLoadDriverPrivilege	2328	rundll32.exe
Token: SeSystemProfilePrivilege	2328	rundll32.exe
Token: SeSystemtimePrivilege	2328	rundll32.exe
Token: SeProfSingleProcessPrivilege	2328	rundll32.exe
Token: SeIncBasePriorityPrivilege	2328	rundll32.exe
Token: SeCreatePagefilePrivilege	2328	rundll32.exe
Token: SeShutdownPrivilege	2328	rundll32.exe
Token: SeDebugPrivilege	2328	rundll32.exe
Token: SeSystemEnvironmentPrivilege	2328	rundll32.exe
Token: SeRemoteShutdownPrivilege	2328	rundll32.exe
Token: SeUndockPrivilege	2328	rundll32.exe
Token: SeManageVolumePrivilege	2328	rundll32.exe
Token: 33	2328	rundll32.exe
Token: 34	2328	rundll32.exe
Token: 35	2328	rundll32.exe
Token: 36	2328	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 2328	3420	rundll32.exe	85
PID 3420 wrote to memory of 2328	3420	rundll32.exe	85
PID 3420 wrote to memory of 2328	3420	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cad4c91ffee634600361faf22b64e36e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cad4c91ffee634600361faf22b64e36e.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads