9f1f4ad301c9ac7726690e9273503600b28495305d3d4907ea7a5f796a796f98

Analysis

max time kernel
141s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2022 07:07

Target

9f1f4ad301c9ac7726690e9273503600b28495305d3d4907ea7a5f796a796f98.dll
Size

116KB
MD5

65ff82075607b2a67c2d2783bbced753
SHA1

6ad88d728dff68a35161cc0868ee54e265cb6a4e
SHA256

9f1f4ad301c9ac7726690e9273503600b28495305d3d4907ea7a5f796a796f98
SHA512

43dc64b827f210db1ed898723889610e4ae3119550470f6627d1d2beabe8b245de74db9dce7b922664c9a41cf0e6430420c0fc38afd7120ac1efbce1a3848257
SSDEEP

1536:Mo9qHjRja57+lkRtGuqo5LUO883T0eHkRbsTchA:Me2a57+lkRtXqWD0UTchA

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2060-133-0x0000000010000000-0x000000001006D000-memory.dmp	upx
behavioral2/memory/2060-137-0x0000000010000000-0x000000001006D000-memory.dmp	upx
behavioral2/memory/2060-138-0x0000000010000000-0x000000001006D000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\89f697a697f5a7ae7094d3d50359482b0063053729e0966277ca9c103da4f1f9.pad	rundll32.exe
File opened for modification	C:\PROGRA~3\89f697a697f5a7ae7094d3d50359482b0063053729e0966277ca9c103da4f1f9.pad	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2060	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2060	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 2060	2620	rundll32.exe	81
PID 2620 wrote to memory of 2060	2620	rundll32.exe	81
PID 2620 wrote to memory of 2060	2620	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f1f4ad301c9ac7726690e9273503600b28495305d3d4907ea7a5f796a796f98.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f1f4ad301c9ac7726690e9273503600b28495305d3d4907ea7a5f796a796f98.dll,#1
  2⤵
  - Drops file in Program Files directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2060

memory/2060-133-0x0000000010000000-0x000000001006D000-memory.dmp

Filesize
436KB

Download
memory/2060-137-0x0000000010000000-0x000000001006D000-memory.dmp

Filesize
436KB

Download
memory/2060-138-0x0000000010000000-0x000000001006D000-memory.dmp

Filesize
436KB

Download