36cba9d47344e954cf64c16128fca7cb03a44f0129a6d17ade7f3a343a547c67

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16-08-2023 10:04

Target

36cba9d47344e954cf64c16128fca7cb03a44f0129a6d17ade7f3a343a547c67.dll
Size

1.8MB
MD5

c3ac7bfe6388bbd44663ecc167839cf5
SHA1

99ca386ed74bafd2d272250192abd16d2685dcec
SHA256

36cba9d47344e954cf64c16128fca7cb03a44f0129a6d17ade7f3a343a547c67
SHA512

a7599dd54ec66e516b403877e296d793bd61606dd88dc41c85c4d2e73e49351b412e1c3245a21d2a0d46ce3f065e8bee077d1120ec4f4e9c70f4009d83d270e4
SSDEEP

24576:bUoV4igAXZ/Y2Y7PF5hYiQJSw8tN6KthpyMPSmYbOn7GcgqBh3SWgSklWATW5l:bY7ZQgthpPzYbO7PBST1Woy

Score

7^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
1188	rundll32mgr.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/files/0x0007000000023218-138.dat	upx
behavioral2/files/0x0007000000023218-136.dat	upx
behavioral2/memory/1188-137-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral2/memory/1188-150-0x0000000000400000-0x000000000045B000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4156	1188	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of SetWindowsHookEx 4 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 3168	1564	rundll32.exe	82
PID 1564 wrote to memory of 3168	1564	rundll32.exe	82
PID 1564 wrote to memory of 3168	1564	rundll32.exe	82
PID 3168 wrote to memory of 1188	3168	rundll32.exe	83
PID 3168 wrote to memory of 1188	3168	rundll32.exe	83
PID 3168 wrote to memory of 1188	3168	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36cba9d47344e954cf64c16128fca7cb03a44f0129a6d17ade7f3a343a547c67.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\36cba9d47344e954cf64c16128fca7cb03a44f0129a6d17ade7f3a343a547c67.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3168
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    PID:1188
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 276
      4⤵
      Program crash
      PID:4156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1188 -ip 1188
1⤵
PID:3504

C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
105KB

MD5
dfb5daabb95dcfad1a5faf9ab1437076

SHA1
4a199569a9b52911bee7fb19ab80570cc5ff9ed1

SHA256
54282ec29d4993ed6e9972122cfbb70bba4898a21d527bd9e72a166d7ec2fdc0

SHA512
5d31c34403ab5f8db4a6d84f2b5579d4ea18673914b626d78e458a648ac20ddd8e342818e807331036d7bb064f596a02b9737acac42fbead29260343a30717e8

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
105KB

MD5
dfb5daabb95dcfad1a5faf9ab1437076

SHA1
4a199569a9b52911bee7fb19ab80570cc5ff9ed1

SHA256
54282ec29d4993ed6e9972122cfbb70bba4898a21d527bd9e72a166d7ec2fdc0

SHA512
5d31c34403ab5f8db4a6d84f2b5579d4ea18673914b626d78e458a648ac20ddd8e342818e807331036d7bb064f596a02b9737acac42fbead29260343a30717e8

Download Submit
memory/1188-139-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/1188-137-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1188-150-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3168-133-0x0000000010000000-0x000000001021F000-memory.dmp

Filesize
2.1MB

Download
memory/3168-149-0x0000000010000000-0x000000001021F000-memory.dmp

Filesize
2.1MB

Download
memory/3168-151-0x0000000010000000-0x000000001021F000-memory.dmp

Filesize
2.1MB

Download