ec70674d7de3ebdf9884b5562ded352ba02e9fcc6d2a6d562093ff650f9b0eb7

Analysis

max time kernel
161s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
16/10/2023, 18:34

Target

NEAS.b8fa4705bba011751fff5a532464c480.dll
Size

76KB
MD5

b8fa4705bba011751fff5a532464c480
SHA1

274d52163af2019c05d229981fd46d92e160d563
SHA256

ec70674d7de3ebdf9884b5562ded352ba02e9fcc6d2a6d562093ff650f9b0eb7
SHA512

ef1c4652ddc229c88d00293dc85ba680debe8b973998d10e6048f71c6291958a0620873796d9ac61aa7fadc84d9d2d2e949e24bc65092b1aa97d7bd243f5c9aa
SSDEEP

1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZJZJRA:c8y93KQjy7G55riF1cMo03O

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/452-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/452-1-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4068	452	WerFault.exe	83

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	452	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 452	5008	rundll32.exe	83
PID 5008 wrote to memory of 452	5008	rundll32.exe	83
PID 5008 wrote to memory of 452	5008	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.b8fa4705bba011751fff5a532464c480.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.b8fa4705bba011751fff5a532464c480.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:452
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 452 -s 700
    3⤵
    - Program crash
    PID:4068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 452 -ip 452
1⤵
PID:4272

memory/452-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/452-1-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download