d9e1c06fea6c40f39e73d8b848122566c6a53753e9d8ad33886acc8b4a2cd38a

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 23:52

Target

07a0b800f74285b69f4beff8676f972a.dll
Size

19KB
MD5

07a0b800f74285b69f4beff8676f972a
SHA1

66ea6b15322b57d777e667744ce4b1bc30ad54a9
SHA256

d9e1c06fea6c40f39e73d8b848122566c6a53753e9d8ad33886acc8b4a2cd38a
SHA512

f32fb9ae46731904d8590cc64f2686275b6bfbe04dbdb44a55d1e5a77e6327d452be622eec07aa227616bee1464ffe68cd20ac923d7b35ea4e1dfc3a44b9ce95
SSDEEP

384:HVKufl5/Px8ASSnC4YHltdS8/Rgj1Tl8fLh6P6vVPfE70U4C:HVxjx8JcCjdv/RgGLcCvVPMjH

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2988-3-0x0000000000170000-0x0000000000182000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2988	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 2988	2832	rundll32.exe	28
PID 2832 wrote to memory of 2988	2832	rundll32.exe	28
PID 2832 wrote to memory of 2988	2832	rundll32.exe	28
PID 2832 wrote to memory of 2988	2832	rundll32.exe	28
PID 2832 wrote to memory of 2988	2832	rundll32.exe	28
PID 2832 wrote to memory of 2988	2832	rundll32.exe	28
PID 2832 wrote to memory of 2988	2832	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\07a0b800f74285b69f4beff8676f972a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\07a0b800f74285b69f4beff8676f972a.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2988

memory/2988-0-0x0000000000160000-0x0000000000172000-memory.dmp

Filesize
72KB

Download
memory/2988-1-0x0000000000160000-0x0000000000172000-memory.dmp

Filesize
72KB

Download
memory/2988-2-0x0000000000160000-0x0000000000172000-memory.dmp

Filesize
72KB

Download
memory/2988-3-0x0000000000170000-0x0000000000182000-memory.dmp

Filesize
72KB

Download