442c5e4c8e56bf5fb453fa70d9afefac6d8aad0d861db57055ad4e8bbe31535f | Triage

Analysis

max time kernel
95s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2024 11:05

Sharing

Report Analysis Logs

General

Target

jli.dll
Size

3.7MB
MD5

ab00251a16e0b607232483e4548f4b5b
SHA1

59e921397449cdf81789159dc2567e7dd0864d1d
SHA256

594d7beb2dafb0ad54e415d09fe2421eb7fa0554685d99171fbd10dc646f4e58
SHA512

fd77e1a779efe5467bb9390488d4d22396c2a6c3b5b63de1ab9fc64907f0507996fba320956df1eebaefe04f482c9ee64d429b188d5baf308dbd117c3fbf0bbf
SSDEEP

49152:MJPwtJEdvqUcEoHd2CkhA45YQzpx9gF0l9XtVYNR5PlDyr:MOtdUo8YQpYBlD

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4644 set thread context of 2108	4644	rundll32.exe	82

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3372	2108	WerFault.exe	82

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4644	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 2108	4644	rundll32.exe	82
PID 4644 wrote to memory of 2108	4644	rundll32.exe	82
PID 4644 wrote to memory of 2108	4644	rundll32.exe	82
PID 4644 wrote to memory of 2108	4644	rundll32.exe	82
PID 4644 wrote to memory of 2108	4644	rundll32.exe	82
PID 4644 wrote to memory of 2108	4644	rundll32.exe	82
PID 4644 wrote to memory of 2108	4644	rundll32.exe	82
PID 4644 wrote to memory of 2108	4644	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jli.dll,#1
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  PID:2108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 80
    3⤵
    - Program crash
    PID:3372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2108 -ip 2108
1⤵
PID:4964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads