799b2cea6c34325380d7db629fdd064d51e7cec540f6401dc2e9549b5eb4fca7

Analysis

max time kernel
140s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 11:57

Target

799b2cea6c34325380d7db629fdd064d51e7cec540f6401dc2e9549b5eb4fca7.dll
Size

76KB
MD5

8ecbcb75a1707d5840e22b4deb002b95
SHA1

773b6f4ccff8620263a8e9aa511bce75776b2a90
SHA256

799b2cea6c34325380d7db629fdd064d51e7cec540f6401dc2e9549b5eb4fca7
SHA512

cdb4f77de2bd6f2c87c72800158a76b77114be7a856d1ef69213d756425b9effae4012595b53b312749c8368b4cb3f76ac38d486af5e17730800a9b56a8fba01
SSDEEP

1536:JLwmzkn+mBg+r5GgLdEkK9fNEjP0UcEtKCQV4i6No06:h8g+t5LdEkKl80gKR+iM0

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4860-133-0x0000000010000000-0x0000000010034000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3080	4860	WerFault.exe	81

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4860	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 4860	4656	rundll32.exe	81
PID 4656 wrote to memory of 4860	4656	rundll32.exe	81
PID 4656 wrote to memory of 4860	4656	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\799b2cea6c34325380d7db629fdd064d51e7cec540f6401dc2e9549b5eb4fca7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\799b2cea6c34325380d7db629fdd064d51e7cec540f6401dc2e9549b5eb4fca7.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 676
    3⤵
    - Program crash
    PID:3080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4860 -ip 4860
1⤵
PID:4288

memory/4860-132-0x0000000000000000-mapping.dmp

Download
memory/4860-133-0x0000000010000000-0x0000000010034000-memory.dmp

Filesize
208KB

Download