283765c310eff2ec907eb802484f6b9e6abc80436e7f1318aa1554d058aa8192

Analysis

max time kernel
141s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 01:45

Target

lpk.dll
Size

45KB
MD5

253047ba1fb3f5780f656e42468a98b6
SHA1

41df12eff92915354f6870ece0fe09c03e96eaa4
SHA256

5ab6d1bc176cc636e82dca6c557c49d06f06016d829aca6cec4761624231ce6d
SHA512

1866f515851eaa71c4213a4680f239b88b38e88371a3414e3f7079321b740e45fa36c96304eb55e09c16a83532b4fa4c466f5fd3bf947e46cfcd8cb4c96b6dc3
SSDEEP

768:tojY9P93amUkTe2uVf8VPZUpRwqK8RPRDUbojyH6ojY9P:Ym1a9iexVfevagojyHDm

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
3500	hrl780E.tmp
4936	gyggue.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\gyggue.exe	hrl780E.tmp
File opened for modification	C:\Windows\SysWOW64\gyggue.exe	hrl780E.tmp

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4936 set thread context of 1140	4936	gyggue.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4660	1140	WerFault.exe	86

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 1052	3252	rundll32.exe	83
PID 3252 wrote to memory of 1052	3252	rundll32.exe	83
PID 3252 wrote to memory of 1052	3252	rundll32.exe	83
PID 1052 wrote to memory of 3500	1052	rundll32.exe	84
PID 1052 wrote to memory of 3500	1052	rundll32.exe	84
PID 1052 wrote to memory of 3500	1052	rundll32.exe	84
PID 4936 wrote to memory of 1140	4936	gyggue.exe	86
PID 4936 wrote to memory of 1140	4936	gyggue.exe	86
PID 4936 wrote to memory of 1140	4936	gyggue.exe	86
PID 4936 wrote to memory of 1140	4936	gyggue.exe	86
PID 4936 wrote to memory of 1140	4936	gyggue.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lpk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lpk.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Users\Admin\AppData\Local\Temp\hrl780E.tmp
    C:\Users\Admin\AppData\Local\Temp\hrl780E.tmp
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:3500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1140 -ip 1140
1⤵
PID:1180

C:\Users\Admin\AppData\Local\Temp\hrl780E.tmp

Filesize
37KB

MD5
e90d8273d9f418adc5c2cb4e1e995559

SHA1
e7dff32bc9671d85e347415f5d5011acdd8aa9e6

SHA256
514319a4883c27820f1f08581aa3a0853643015ee0f4ec742739c118b327bdb1

SHA512
1dbf053d564039ca8c80f7fd6989dbdb42b191da6bbd70c97f81f41567891d6672910dd9c736a32146c896e2159677b41b3e46007ce70d9d4d9ea223a6b8a6d7

Download Submit
memory/1140-7-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download