c58594d414c882ce33499233c2f508789e5fa4d91b79ef01d763012e39d7b095

Analysis

Target
dip.dll
Size 3.3MB
Sample201109-d3qlchnakn
SHA256 c58594d414c882ce33499233c2f508789e5fa4d91b79ef01d763012e39d7b095
MD5 d22c98237b0eae8d57171beb23bf958e
SHA1 4cac658d4d2802f56852cd0f09ba161d675910a0
SHA512 0de485d7e204265ad7f9addc7e2c8a289236c45b74c44df43d3b3701ae907815a915165aca1d77cde9575827582492f62bbf8a98552bca871c18cc4be204f613
MD5 SHA1 SHA512

Score

9^/10

ServiceHost packer 3 IoCs

Detects ServiceHost packer used for .NET malware

resource	yara_rule
behavioral2/memory/1208-3-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/1208-4-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/1208-5-0x0000000000000000-mapping.dmp	servicehost

Blacklisted process makes network request 5 IoCs

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1612	1208	WerFault.exe	70

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 728 wrote to memory of 1208	728	rundll32.exe	70
PID 728 wrote to memory of 1208	728	rundll32.exe	70
PID 728 wrote to memory of 1208	728	rundll32.exe	70
PID 1208 wrote to memory of 3704	1208	rundll32.exe	79
PID 1208 wrote to memory of 3704	1208	rundll32.exe	79
PID 1208 wrote to memory of 3704	1208	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dip.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dip.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\dip.dll,f0
    3⤵
    - Blacklisted process makes network request
    PID:3704
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 740
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1612

memory/1612-2-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Download

memory/1612-6-0x0000000005440000-0x0000000005441000-memory.dmp

Download