8121f98b64ac359b075db9c65509b5d66fb3ef8a623fdece75804003b0534ace

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
21/09/2023, 00:49

Target

8121f98b64ac359b075db9c65509b5d66fb3ef8a623fdece75804003b0534ace.dll
Size

1.6MB
MD5

f77e5733a66ee935042600fe28450a0d
SHA1

9df47fe07b278f57625c98395b49b2a406b589f8
SHA256

8121f98b64ac359b075db9c65509b5d66fb3ef8a623fdece75804003b0534ace
SHA512

fea3575d3d80aa8740a06908748d6ac6e38e483ef321fef0b826b0d4ef16f96e4a363b3d99d8cfb21431087af92f624a40e91be362ba79525332dab452325cc0
SSDEEP

24576:yzwm2XpjYcWQ+azRrz+ItgJwL1jSg9SWwdA3qBzmnJXCp2kHWDN/A1xrleHt8z+a:77r1hz/D1j59Hwd2nn1Ktct8zV5

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1936-0-0x0000000010000000-0x000000001061E000-memory.dmp	upx
behavioral1/memory/1936-1-0x0000000010000000-0x000000001061E000-memory.dmp	upx
behavioral1/memory/1936-17-0x0000000010000000-0x000000001061E000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1936	rundll32.exe
1936	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1936	rundll32.exe
Token: SeDebugPrivilege	1936	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1936	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 1936	2440	rundll32.exe	28
PID 2440 wrote to memory of 1936	2440	rundll32.exe	28
PID 2440 wrote to memory of 1936	2440	rundll32.exe	28
PID 2440 wrote to memory of 1936	2440	rundll32.exe	28
PID 2440 wrote to memory of 1936	2440	rundll32.exe	28
PID 2440 wrote to memory of 1936	2440	rundll32.exe	28
PID 2440 wrote to memory of 1936	2440	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8121f98b64ac359b075db9c65509b5d66fb3ef8a623fdece75804003b0534ace.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8121f98b64ac359b075db9c65509b5d66fb3ef8a623fdece75804003b0534ace.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1936

memory/1936-0-0x0000000010000000-0x000000001061E000-memory.dmp

Filesize
6.1MB

Download
memory/1936-1-0x0000000010000000-0x000000001061E000-memory.dmp

Filesize
6.1MB

Download
memory/1936-17-0x0000000010000000-0x000000001061E000-memory.dmp

Filesize
6.1MB

Download