2e31b1e1b0821c7a6529c74e0f1cb4ab435dceaf933467696c41d981bf43cf2a | Triage

Analysis

max time kernel
91s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 16:39

Sharing

Report Analysis Logs

General

Target

VCAssist.dll
Size

220KB
MD5

7ae0ef5ee2d843b80b18a81f9e350e62
SHA1

2711e94d86e6a66027748ac2575d90cdb06634b8
SHA256

ca566faafe1c515d1e440ef7dcaa97c2a70bd29f2c368c74a6bfef8cad07dc2d
SHA512

ce421874b621a8dbb7bfc40abdb727a2ecbe2dc1d28fd92a1c5d11389b7e111d983d9ac63e8b80b73e40ea26d1706a77287dea51cd3fbc05a32697002c87e15d
SSDEEP

6144:mGd7TlLZRIfCWFEZVleksPkPWF2jFXzn9xpc3H/UfPZ:TNIk+2jR9xpc3H2Z

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1520	3608	WerFault.exe	83

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3608	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 3608	3984	rundll32.exe	83
PID 3984 wrote to memory of 3608	3984	rundll32.exe	83
PID 3984 wrote to memory of 3608	3984	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VCAssist.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\VCAssist.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 728
    3⤵
    - Program crash
    PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3608 -ip 3608
1⤵
PID:3708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads