250226d60bf1cb4179b62aa61d95926b749a907d3038296defc49479017e3024

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 07:10

Target

250226d60bf1cb4179b62aa61d95926b749a907d3038296defc49479017e3024.dll
Size

387KB
MD5

a74c3791f65cf64e54dc1ccc09301af0
SHA1

53d2bb6726aceceb70755e0ab00662152b0a41b1
SHA256

250226d60bf1cb4179b62aa61d95926b749a907d3038296defc49479017e3024
SHA512

1887bb08174ab8dc49123e76807048c44644c2383c307b92816b3a9aff1d28556cf5c9eb404898543e16fc9978c5b2209cdd7e940a01307f174d38ca71336f4f
SSDEEP

6144:ZK4YbgsRDI9Spg3QfnH7wFWZZGgC6Qx5lhtytABV+UdvrEFp7hKI:ZK1bgWI9AgkbKWZhYPnqABjvrEH7j

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
624	rundll32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/624-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/624-8-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	rundll32.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3440	624	WerFault.exe	16
2672	624	WerFault.exe	16

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	624	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 624	1948	rundll32.exe	16
PID 1948 wrote to memory of 624	1948	rundll32.exe	16
PID 1948 wrote to memory of 624	1948	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\250226d60bf1cb4179b62aa61d95926b749a907d3038296defc49479017e3024.dll,#1
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 720
  2⤵
  - Program crash
  PID:3440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 764
  2⤵
  - Program crash
  PID:2672

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\250226d60bf1cb4179b62aa61d95926b749a907d3038296defc49479017e3024.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 624 -ip 624
1⤵
PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 624 -ip 624
1⤵
PID:2040

memory/624-5-0x00000000757B0000-0x00000000757FD000-memory.dmp

Filesize
308KB

Download
memory/624-4-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/624-8-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download