250226d60bf1cb4179b62aa61d95926b749a907d3038296defc49479017e3024

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 07:10

Target

250226d60bf1cb4179b62aa61d95926b749a907d3038296defc49479017e3024.dll
Size

387KB
MD5

a74c3791f65cf64e54dc1ccc09301af0
SHA1

53d2bb6726aceceb70755e0ab00662152b0a41b1
SHA256

250226d60bf1cb4179b62aa61d95926b749a907d3038296defc49479017e3024
SHA512

1887bb08174ab8dc49123e76807048c44644c2383c307b92816b3a9aff1d28556cf5c9eb404898543e16fc9978c5b2209cdd7e940a01307f174d38ca71336f4f
SSDEEP

6144:ZK4YbgsRDI9Spg3QfnH7wFWZZGgC6Qx5lhtytABV+UdvrEFp7hKI:ZK1bgWI9AgkbKWZhYPnqABjvrEH7j

Score

8^/10

upx

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	2992	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
2992	rundll32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2992-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2992-7-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2992	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2992	2988	rundll32.exe	16
PID 2988 wrote to memory of 2992	2988	rundll32.exe	16
PID 2988 wrote to memory of 2992	2988	rundll32.exe	16
PID 2988 wrote to memory of 2992	2988	rundll32.exe	16
PID 2988 wrote to memory of 2992	2988	rundll32.exe	16
PID 2988 wrote to memory of 2992	2988	rundll32.exe	16
PID 2988 wrote to memory of 2992	2988	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\250226d60bf1cb4179b62aa61d95926b749a907d3038296defc49479017e3024.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\250226d60bf1cb4179b62aa61d95926b749a907d3038296defc49479017e3024.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  PID:2992

memory/2992-3-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2992-6-0x0000000074540000-0x000000007458D000-memory.dmp

Filesize
308KB

Download
memory/2992-5-0x0000000074540000-0x000000007458D000-memory.dmp

Filesize
308KB

Download
memory/2992-7-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download