e1a876852a42d221b5bb7a2d934e50c31d2006f9df258dab589b0078cc6c63f3 | Triage

Analysis

max time kernel
140s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 19:55

Sharing

Report Analysis Logs

General

Target

GamePingBooster/AGIpHelperClose.dll
Size

96KB
MD5

b33bef46898db3038d755e2881ab6d6a
SHA1

e2969a1d6cdb3def6f79a3a9a2b88f4bf0845de4
SHA256

d0b0c67bb766002d4be097ced6b53edc94fd423b6d8f50355be48add0626a35d
SHA512

f96e9825c292d479be8ac0716c0a813b984dd16cef9f7f0958fdc49c5e26e10f0e21480435b6bdb563a99e0889b9d148798f610e234c701175bd50bc2847e9ab
SSDEEP

3072:oh9yC1PmpV/2fgBbcl1UKmkwQl2dMZ8w0:cyJJ2fUdkZ2dMl0

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3684	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 3684	3080	rundll32.exe	90
PID 3080 wrote to memory of 3684	3080	rundll32.exe	90
PID 3080 wrote to memory of 3684	3080	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GamePingBooster\AGIpHelperClose.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\GamePingBooster\AGIpHelperClose.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3756 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
1⤵
PID:1744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads