Overview

overview

7

Static

static

3

windirstat...up.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$_5_.exe

windows10-2004-x64

7

Uninstall.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows10-2004-x64

3

shfolder.dll

windows10-2004-x64

1

wdsh0407.chm

windows10-2004-x64

1

wdsh040e.chm

windows10-2004-x64

1

wdsh0415.chm

windows10-2004-x64

1

wdsr0405.dll

windows10-2004-x64

1

wdsr0407.dll

windows10-2004-x64

1

wdsr040a.dll

windows10-2004-x64

1

wdsr040b.dll

windows10-2004-x64

1

wdsr040c.dll

windows10-2004-x64

1

wdsr040e.dll

windows10-2004-x64

1

wdsr0410.dll

windows10-2004-x64

1

wdsr0413.dll

windows10-2004-x64

1

wdsr0415.dll

windows10-2004-x64

1

wdsr0419.dll

windows10-2004-x64

1

wdsr0425.dll

windows10-2004-x64

1

windirstat.chm

windows10-2004-x64

1

windirstat.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    431s
  • max time network
    439s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-03-2024 19:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    wdsr0410.dll

  • Size

    60KB

  • MD5

    fc6f4868c21cc2b2c58882b3956462c5

  • SHA1

    2aceeaa4bd9557880cffa3603cd25c51e9ce5a1c

  • SHA256

    e9c30274fcdeaa43acaeba3eac86628107ef60dbea723ececa97008b80f40fba

  • SHA512

    34990a37f943a3953cc638ba56cd6251f2609eb3b5befa11c888b1d1902ae3724b6e8141706caa616b63245ce9dd75fa3ff2bb63d6e2f53a496692e280647ffe

  • SSDEEP

    768:sHqiKwZ/nujjVfHZEIaGgDqBlDZaKCam:sH7du3tHZEIaGgGCam

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\wdsr0410.dll,#1
    1⤵
      PID:776
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
      1⤵
        PID:396
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k UnistackSvcGroup
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3428

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/3428-0-0x00000227560A0000-0x00000227560B0000-memory.dmp
        Filesize

        64KB

        Download
      • memory/3428-16-0x00000227561A0000-0x00000227561B0000-memory.dmp
        Filesize

        64KB

        Download
      • memory/3428-32-0x000002275E790000-0x000002275E791000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3428-33-0x000002275E7C0000-0x000002275E7C1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3428-34-0x000002275E7C0000-0x000002275E7C1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3428-35-0x000002275E7C0000-0x000002275E7C1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3428-36-0x000002275E7C0000-0x000002275E7C1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3428-37-0x000002275E7C0000-0x000002275E7C1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3428-38-0x000002275E7C0000-0x000002275E7C1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3428-39-0x000002275E7C0000-0x000002275E7C1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3428-40-0x000002275E7C0000-0x000002275E7C1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3428-41-0x000002275E7C0000-0x000002275E7C1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3428-42-0x000002275E7C0000-0x000002275E7C1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3428-43-0x000002275E3E0000-0x000002275E3E1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3428-44-0x000002275E3D0000-0x000002275E3D1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3428-46-0x000002275E3E0000-0x000002275E3E1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3428-49-0x000002275E3D0000-0x000002275E3D1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3428-52-0x000002275E310000-0x000002275E311000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3428-64-0x000002275E510000-0x000002275E511000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3428-66-0x000002275E520000-0x000002275E521000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3428-67-0x000002275E520000-0x000002275E521000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3428-68-0x000002275E630000-0x000002275E631000-memory.dmp
        Filesize

        4KB

        Download