2e31b1e1b0821c7a6529c74e0f1cb4ab435dceaf933467696c41d981bf43cf2a | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 16:39

Sharing

Report Analysis Logs

General

Target

VCAssist.dll
Size

220KB
MD5

7ae0ef5ee2d843b80b18a81f9e350e62
SHA1

2711e94d86e6a66027748ac2575d90cdb06634b8
SHA256

ca566faafe1c515d1e440ef7dcaa97c2a70bd29f2c368c74a6bfef8cad07dc2d
SHA512

ce421874b621a8dbb7bfc40abdb727a2ecbe2dc1d28fd92a1c5d11389b7e111d983d9ac63e8b80b73e40ea26d1706a77287dea51cd3fbc05a32697002c87e15d
SSDEEP

6144:mGd7TlLZRIfCWFEZVleksPkPWF2jFXzn9xpc3H/UfPZ:TNIk+2jR9xpc3H2Z

Score

1^/10

Malware Config

Signatures

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
476	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	852	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 852	2488	rundll32.exe	31
PID 2488 wrote to memory of 852	2488	rundll32.exe	31
PID 2488 wrote to memory of 852	2488	rundll32.exe	31
PID 2488 wrote to memory of 852	2488	rundll32.exe	31
PID 2488 wrote to memory of 852	2488	rundll32.exe	31
PID 2488 wrote to memory of 852	2488	rundll32.exe	31
PID 2488 wrote to memory of 852	2488	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VCAssist.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\VCAssist.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads