c1411695a46008567ed81c474298a6cade2e743d50019acb46407ed66cb11b0e | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-02-2025 09:58

Sharing

Report Analysis Logs

General

Target

msvcp144.dll
Size

3.8MB
MD5

861908c05742756c7cd6ee22daec451b
SHA1

1686abfda1ea36ef9ea508d4516dfef1734a83ff
SHA256

128f96765d8b0f94922fcc7b79cce90cfde66f7aa835aaa6745d2ccb96471b42
SHA512

638252daf3fa5fc1eef85f9f3e30c8aec226ef8c593a00992f1bc3c4d3ffc961a1b119aed012317359af3ef9a883408fc429806225d313eced10219540882a33
SSDEEP

49152:Xo4jX82pc5kYFtjNgRBQEf7DwbyKslgFF6Z7Ye6+Kr:ZQ6yqws6Xr

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\1woi1z.exe	rundll32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\1woi1z.exe	rundll32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2164	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp144.dll,#1
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads