01d7e523f0474bd4e22f9cf3064d8cdb5fb46a20d7ae24e810ab8e0503cdceed

Analysis

max time kernel
27s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:07

Target

01d7e523f0474bd4e22f9cf3064d8cdb5fb46a20d7ae24e810ab8e0503cdceed.dll
Size

129KB
MD5

1823ab374c366079437f41f98f485586
SHA1

f10c5c3e93565882334d3eb0bbfb5c3c7a94dbda
SHA256

01d7e523f0474bd4e22f9cf3064d8cdb5fb46a20d7ae24e810ab8e0503cdceed
SHA512

481066487e37cf47c2d8a996592e08e803fa53e7f1fb0715067cfb0ca6174aabdc26fa1525de194fd4933d5f5ca5dd17ec8dc9c6f492748343e361331a8276e4
SSDEEP

3072:GVDkUQpJjGA0L/ono47Xxwjgir33hoUYPnjU:GVanq1ronov36Pg

Score

8^/10

upx

Drops file in Drivers directory 4 IoCs

Processes:

rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\drivers\ntfsny.sys	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ntfsny.sys	rundll32.exe
File created	C:\Windows\SysWOW64\drivers\ahnsvr.sys	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ahnsvr.sys	rundll32.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1236-56-0x0000000010000000-0x0000000010036000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\midisappe.dll rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\midisappe.dll	rundll32.exe

Drops file in Windows directory 4 IoCs

Processes:

rundll32.exe

description	ioc	process
File created	C:\Windows\tasks\ahnsvr.dat	rundll32.exe
File created	C:\Windows\tasks\midisappe.dat	rundll32.exe
File opened for modification	C:\Windows\tasks\midisappe.dat	rundll32.exe
File created	C:\Windows\tasks\ntfsny.dat	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1236 rundll32.exe
Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

460
460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rundll32.exe

description pid process

Token: SeDebugPrivilege 1236 rundll32.exe

pid	process
1236	rundll32.exe

pid	process
460
460

description	pid	process
Token: SeDebugPrivilege	1236	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1348 wrote to memory of 1236	1348	rundll32.exe	rundll32.exe
PID 1348 wrote to memory of 1236	1348	rundll32.exe	rundll32.exe
PID 1348 wrote to memory of 1236	1348	rundll32.exe	rundll32.exe
PID 1348 wrote to memory of 1236	1348	rundll32.exe	rundll32.exe
PID 1348 wrote to memory of 1236	1348	rundll32.exe	rundll32.exe
PID 1348 wrote to memory of 1236	1348	rundll32.exe	rundll32.exe
PID 1348 wrote to memory of 1236	1348	rundll32.exe	rundll32.exe
PID 1236 wrote to memory of 1188	1236	rundll32.exe	Explorer.EXE

memory/1236-54-0x0000000000000000-mapping.dmp

Download
memory/1236-55-0x0000000074F41000-0x0000000074F43000-memory.dmp

Filesize
8KB

Download
memory/1236-56-0x0000000010000000-0x0000000010036000-memory.dmp

Filesize
216KB

Download