bb5ac982b245481fa0aa3e168d7ae6a98fc23f1e05dc55d7b52d2ee5617fc136

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
13-11-2023 02:38

Target

NEAS.a07f0527ea5e744d549f9445368a6060.dll
Size

76KB
MD5

a07f0527ea5e744d549f9445368a6060
SHA1

6b8cda97e1c101d407592281f6242e0833ba43c6
SHA256

bb5ac982b245481fa0aa3e168d7ae6a98fc23f1e05dc55d7b52d2ee5617fc136
SHA512

9b70f49973ce999ed25ea94af143c6cc5b0c3bd6f8199b2e5037f2c485326ccc54eaeb6b98e688646d6f9d43e27b0b6dda27da6d04784353127318ce5b616849
SSDEEP

1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZO:c8y93KQjy7G55riF1cMo03w

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1952-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1952-1-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1952-2-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1952-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2352	1952	WerFault.exe	29

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1952	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1952	2236	rundll32.exe	29
PID 2236 wrote to memory of 1952	2236	rundll32.exe	29
PID 2236 wrote to memory of 1952	2236	rundll32.exe	29
PID 2236 wrote to memory of 1952	2236	rundll32.exe	29
PID 2236 wrote to memory of 1952	2236	rundll32.exe	29
PID 2236 wrote to memory of 1952	2236	rundll32.exe	29
PID 2236 wrote to memory of 1952	2236	rundll32.exe	29
PID 1952 wrote to memory of 2352	1952	rundll32.exe	30
PID 1952 wrote to memory of 2352	1952	rundll32.exe	30
PID 1952 wrote to memory of 2352	1952	rundll32.exe	30
PID 1952 wrote to memory of 2352	1952	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.a07f0527ea5e744d549f9445368a6060.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.a07f0527ea5e744d549f9445368a6060.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 336
    3⤵
    - Program crash
    PID:2352

memory/1952-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1952-1-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1952-2-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1952-3-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download