f44e565e83704d184151eaa9cd008c57f60fa468544cc510328c5e9fb0ef100f

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
23/11/2023, 23:06

Target

f44e565e83704d184151eaa9cd008c57f60fa468544cc510328c5e9fb0ef100f.dll
Size

145KB
MD5

08dca86a759786e7c5663a3ffe22f247
SHA1

ca7b2fcadfb2bd220395e10135b345f83f18b194
SHA256

f44e565e83704d184151eaa9cd008c57f60fa468544cc510328c5e9fb0ef100f
SHA512

91d442702584a2ac47326cb1455e85164eb681145326635844653f076174c4961bfc2ca39f4a7d57925fc3b864fa46f84c576b122381ab9a3555f0fa2974cef0
SSDEEP

3072:Xul9aoQkDG56WwLCjBWkwbj2gZ1hXq7U9DmPhxWuulk9:XV6a1Wkwb5Z1hXqAsPhxy6

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2292-0-0x0000000010000000-0x000000001006D000-memory.dmp	upx
behavioral1/memory/2292-1-0x0000000010000000-0x000000001006D000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2292	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2292	2340	rundll32.exe	28
PID 2340 wrote to memory of 2292	2340	rundll32.exe	28
PID 2340 wrote to memory of 2292	2340	rundll32.exe	28
PID 2340 wrote to memory of 2292	2340	rundll32.exe	28
PID 2340 wrote to memory of 2292	2340	rundll32.exe	28
PID 2340 wrote to memory of 2292	2340	rundll32.exe	28
PID 2340 wrote to memory of 2292	2340	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f44e565e83704d184151eaa9cd008c57f60fa468544cc510328c5e9fb0ef100f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f44e565e83704d184151eaa9cd008c57f60fa468544cc510328c5e9fb0ef100f.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2292

memory/2292-0-0x0000000010000000-0x000000001006D000-memory.dmp

Filesize
436KB

Download
memory/2292-1-0x0000000010000000-0x000000001006D000-memory.dmp

Filesize
436KB

Download