b4e01320fb9a6f9e4dc024c5a2354d39270f303d3d0933a509d6d15c42811a36

Analysis

max time kernel
273s
max time network
315s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 16:32

Target

NEAS.25b6082b417f46d3dc4fcd62a64b1470.dll
Size

76KB
MD5

25b6082b417f46d3dc4fcd62a64b1470
SHA1

e756e0bb7fbcf6d91b5745111a5518b85dda5899
SHA256

b4e01320fb9a6f9e4dc024c5a2354d39270f303d3d0933a509d6d15c42811a36
SHA512

995dfbd51b76c8315c6fdc3f894f4cb3df0190de150a2e0748da80e7925d1c5a58f7bf5107cee8bef31c2e01afc527b3dbf7afae370a03db096d69b16aacf99c
SSDEEP

1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZmYXB+x:c8y93KQjy7G55riF1cMo03QYXBg

Score

7^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2580-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2580-1-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2580-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2580-5-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2580-6-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2296	2580	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2580	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2580	2548	rundll32.exe	27
PID 2548 wrote to memory of 2580	2548	rundll32.exe	27
PID 2548 wrote to memory of 2580	2548	rundll32.exe	27
PID 2548 wrote to memory of 2580	2548	rundll32.exe	27
PID 2548 wrote to memory of 2580	2548	rundll32.exe	27
PID 2548 wrote to memory of 2580	2548	rundll32.exe	27
PID 2548 wrote to memory of 2580	2548	rundll32.exe	27
PID 2580 wrote to memory of 2296	2580	rundll32.exe	28
PID 2580 wrote to memory of 2296	2580	rundll32.exe	28
PID 2580 wrote to memory of 2296	2580	rundll32.exe	28
PID 2580 wrote to memory of 2296	2580	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.25b6082b417f46d3dc4fcd62a64b1470.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.25b6082b417f46d3dc4fcd62a64b1470.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 328
    3⤵
    - Program crash
    PID:2296

memory/2580-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2580-2-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/2580-1-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2580-3-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2580-5-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2580-6-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download