a4b2417ca2cbf7d68778836a91b80ca56c2b0d229f16648723c71fec1ab44d39

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 21:05

Target

a4b2417ca2cbf7d68778836a91b80ca56c2b0d229f16648723c71fec1ab44d39.dll
Size

1.6MB
MD5

c2745c58315b35448ce6d6c91abda564
SHA1

81b9597455af0592cf6ca0452e2802acf7e2e130
SHA256

a4b2417ca2cbf7d68778836a91b80ca56c2b0d229f16648723c71fec1ab44d39
SHA512

f66061cd7b9609208d79c0e7f27fab7e68454638ac3ad3aece722ce5d2bbbdaec33de274f9b0a33880aa3e4c017da8621ad815d767e3e79f8cbb809f237097e5
SSDEEP

49152:EuTKVOAg4TWNwey6uU7ETcxxLThcIBzgJOFB:LTlADSysETcTLTOP+

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2244-0-0x0000000010000000-0x000000001062C000-memory.dmp	upx
behavioral1/memory/2244-2-0x0000000010000000-0x000000001062C000-memory.dmp	upx
behavioral1/memory/2244-18-0x0000000010000000-0x000000001062C000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2244	rundll32.exe
2244	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2244	rundll32.exe
Token: SeDebugPrivilege	2244	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2244	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2244	2232	rundll32.exe	28
PID 2232 wrote to memory of 2244	2232	rundll32.exe	28
PID 2232 wrote to memory of 2244	2232	rundll32.exe	28
PID 2232 wrote to memory of 2244	2232	rundll32.exe	28
PID 2232 wrote to memory of 2244	2232	rundll32.exe	28
PID 2232 wrote to memory of 2244	2232	rundll32.exe	28
PID 2232 wrote to memory of 2244	2232	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4b2417ca2cbf7d68778836a91b80ca56c2b0d229f16648723c71fec1ab44d39.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4b2417ca2cbf7d68778836a91b80ca56c2b0d229f16648723c71fec1ab44d39.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2244

memory/2244-0-0x0000000010000000-0x000000001062C000-memory.dmp

Filesize
6.2MB

Download
memory/2244-2-0x0000000010000000-0x000000001062C000-memory.dmp

Filesize
6.2MB

Download
memory/2244-18-0x0000000010000000-0x000000001062C000-memory.dmp

Filesize
6.2MB

Download