77f26e76d3589e4da0dfaa3644a148abc382d944e131f80000a098965fed4f2c

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 10:27

Target

673ad07ab3792001a02c4ec92d2387b6.dll
Size

207KB
MD5

673ad07ab3792001a02c4ec92d2387b6
SHA1

407ae3240e4e095bcc7051a9e3070f9be778d760
SHA256

77f26e76d3589e4da0dfaa3644a148abc382d944e131f80000a098965fed4f2c
SHA512

7c454ce5fd7826f78a6b0e913b05ea4038369587c6766289dba66a9bb07802b2a59254181b22cf83b2f6a0e6615df449dd9f089851c78e3558c41acbf3fd1baa
SSDEEP

6144:6UdNB19jPCDOqv484ZlPzDh7fUCgUrA6:6UXKDTvXurDSLUr

Score

8^/10

upx

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	1108	rundll32.exe
3	1108	rundll32.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1108-0-0x0000000000730000-0x00000000007C1000-memory.dmp	upx
behavioral1/memory/1108-1-0x0000000000730000-0x00000000007C1000-memory.dmp	upx
behavioral1/memory/1108-2-0x0000000000730000-0x00000000007C1000-memory.dmp	upx
behavioral1/memory/1108-3-0x0000000000730000-0x00000000007C1000-memory.dmp	upx
behavioral1/memory/1108-5-0x0000000000730000-0x00000000007C1000-memory.dmp	upx
behavioral1/memory/1108-7-0x0000000000730000-0x00000000007C1000-memory.dmp	upx

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\windows\winhelp26.ini	rundll32.exe
File created	C:\windows\system\sysconfig.cpl	rundll32.exe
File opened for modification	C:\windows\system\sysconfig.cpl	rundll32.exe
File created	C:\windows\system\sharecode.exe	rundll32.exe
File opened for modification	C:\windows\system\sharecode.exe	rundll32.exe
File created	C:\windows\system\7master_QVMRJQQO.sys	rundll32.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2704	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2704	taskkill.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1108	2000	rundll32.exe	28
PID 2000 wrote to memory of 1108	2000	rundll32.exe	28
PID 2000 wrote to memory of 1108	2000	rundll32.exe	28
PID 2000 wrote to memory of 1108	2000	rundll32.exe	28
PID 2000 wrote to memory of 1108	2000	rundll32.exe	28
PID 2000 wrote to memory of 1108	2000	rundll32.exe	28
PID 2000 wrote to memory of 1108	2000	rundll32.exe	28
PID 1108 wrote to memory of 2704	1108	rundll32.exe	31
PID 1108 wrote to memory of 2704	1108	rundll32.exe	31
PID 1108 wrote to memory of 2704	1108	rundll32.exe	31
PID 1108 wrote to memory of 2704	1108	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\673ad07ab3792001a02c4ec92d2387b6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\673ad07ab3792001a02c4ec92d2387b6.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill.exe -f -im cmd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2704

memory/1108-0-0x0000000000730000-0x00000000007C1000-memory.dmp

Filesize
580KB

Download
memory/1108-1-0x0000000000730000-0x00000000007C1000-memory.dmp

Filesize
580KB

Download
memory/1108-2-0x0000000000730000-0x00000000007C1000-memory.dmp

Filesize
580KB

Download
memory/1108-3-0x0000000000730000-0x00000000007C1000-memory.dmp

Filesize
580KB

Download
memory/1108-4-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/1108-5-0x0000000000730000-0x00000000007C1000-memory.dmp

Filesize
580KB

Download
memory/1108-7-0x0000000000730000-0x00000000007C1000-memory.dmp

Filesize
580KB

Download