b3e233c5d5a6a4c9f24a704ebd3e1b630153cd29118a241cf305c0c2a9f14d71

Analysis

max time kernel
39s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 01:13

Target

b3e233c5d5a6a4c9f24a704ebd3e1b630153cd29118a241cf305c0c2a9f14d71.dll
Size

13KB
MD5

446dae2bf81598519ed489bfaa2adf42
SHA1

6e0d102aa69c00c4f73c102bc910111277c0c9af
SHA256

b3e233c5d5a6a4c9f24a704ebd3e1b630153cd29118a241cf305c0c2a9f14d71
SHA512

52bebc22231c416346ae1dd4fdce3d90c57f07d202988de29e040bd8a6cddafe52514897dc810991db5aa46971e5c9592c8a8d872aab50ec978d5cdd4ba6c1ae
SSDEEP

384:BO3k8DicpUdyZd09hByQI4FMObbDIF4bMW:BaDiuUdOdooQDdbDIF4bMW

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1056-56-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1056	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1056	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1056	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1056	2040	rundll32.exe	28
PID 2040 wrote to memory of 1056	2040	rundll32.exe	28
PID 2040 wrote to memory of 1056	2040	rundll32.exe	28
PID 2040 wrote to memory of 1056	2040	rundll32.exe	28
PID 2040 wrote to memory of 1056	2040	rundll32.exe	28
PID 2040 wrote to memory of 1056	2040	rundll32.exe	28
PID 2040 wrote to memory of 1056	2040	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3e233c5d5a6a4c9f24a704ebd3e1b630153cd29118a241cf305c0c2a9f14d71.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3e233c5d5a6a4c9f24a704ebd3e1b630153cd29118a241cf305c0c2a9f14d71.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:1056

memory/1056-55-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/1056-56-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download