596db0b26451c60e2e618dd98f126e3932e238baa0432867203f83df27debd03 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-11-2024 00:52

Sharing

Report Analysis Logs

General

Target

ce-lib64.dll
Size

2.7MB
MD5

613f165469e6fdfeedfbcac79296906e
SHA1

f90782144ecd3681c76a3e986863240d4e17c215
SHA256

498de4f8bd87cbaf68344742f76e08dd241824148fb25fef8835ef069e56f804
SHA512

3523a3a351fd8f3a49b474dfb6530d8ac77eebdb93eb3711c6beff50aae35e9c0ebd3fd525db10f9fe9707752c87b94134a2ff4b7079149664f0628ef4991fc2
SSDEEP

49152:gSBaMAHsRvK8BsF4G+WcXP8qN2WSkZeMPnvwPD6D3uz:0+RFfG+rB8ws+Y

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

rundll32.exe

description	pid	process
Token: SeDebugPrivilege	2428	rundll32.exe
Token: SeLoadDriverPrivilege	2428	rundll32.exe
Token: SeCreateGlobalPrivilege	2428	rundll32.exe
Token: SeLockMemoryPrivilege	2428	rundll32.exe
Token: 33	2428	rundll32.exe
Token: SeSecurityPrivilege	2428	rundll32.exe
Token: SeTakeOwnershipPrivilege	2428	rundll32.exe
Token: SeManageVolumePrivilege	2428	rundll32.exe
Token: SeBackupPrivilege	2428	rundll32.exe
Token: SeCreatePagefilePrivilege	2428	rundll32.exe
Token: SeShutdownPrivilege	2428	rundll32.exe
Token: SeRestorePrivilege	2428	rundll32.exe
Token: 33	2428	rundll32.exe
Token: SeIncBasePriorityPrivilege	2428	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce-lib64.dll,#1
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads