2f2c57c029e16efb7f6271c847314aba3d10058a1e7caeeec459d9f42962cd8d

Analysis

max time kernel
127s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2023 21:56

Target

NEAS.0bbd78ed60e95ac39d8f327866fef7c0.dll
Size

76KB
MD5

0bbd78ed60e95ac39d8f327866fef7c0
SHA1

92f0f56cea5664843c12a512b51732bc0382f1af
SHA256

2f2c57c029e16efb7f6271c847314aba3d10058a1e7caeeec459d9f42962cd8d
SHA512

000cee448069aceda96b0e8967d87d2c0755630c1c8020613da367225b43bff774c60ec3b9ddf8a6650d65c3a49f2c1c23bf7194de4fe7c01328dd4d800c89cc
SSDEEP

1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZLGphO3Sl:c8y93KQjy7G55riF1cMo03g4U

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4580-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4580-1-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
864	4580	WerFault.exe	85

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4580	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 4580	876	rundll32.exe	85
PID 876 wrote to memory of 4580	876	rundll32.exe	85
PID 876 wrote to memory of 4580	876	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.0bbd78ed60e95ac39d8f327866fef7c0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.0bbd78ed60e95ac39d8f327866fef7c0.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4580
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 712
    3⤵
    - Program crash
    PID:864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4580 -ip 4580
1⤵
PID:4992

memory/4580-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4580-1-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download