90aeab9e0a122b390ea72287972b63bcbd22e981dada8b072b559ffc68f67635

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 21:27

Target

90aeab9e0a122b390ea72287972b63bcbd22e981dada8b072b559ffc68f67635.dll
Size

76KB
MD5

b293c36400c7a64853e85db995fe676c
SHA1

f693a48ca4cd08fb2c6c381e3fe551a3896f4511
SHA256

90aeab9e0a122b390ea72287972b63bcbd22e981dada8b072b559ffc68f67635
SHA512

fcb6d48228d20922da838acc2358791d0d7261d5cf072a916f757e0aec9ed2a1d7513849ad2e7ba99f480f8f03850171d9b4e12b81eccdc3e59845b14f8fd08b
SSDEEP

1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZNiiDVjtAR:c8y93KQjy7G55riF1cMo03PiiDVjtAR

Score

9^/10

upx

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/2720-0-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/2720-2-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/2720-3-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/2720-4-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2720-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2720-2-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2720-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2720-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2720	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2720	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2720	2456	rundll32.exe	28
PID 2456 wrote to memory of 2720	2456	rundll32.exe	28
PID 2456 wrote to memory of 2720	2456	rundll32.exe	28
PID 2456 wrote to memory of 2720	2456	rundll32.exe	28
PID 2456 wrote to memory of 2720	2456	rundll32.exe	28
PID 2456 wrote to memory of 2720	2456	rundll32.exe	28
PID 2456 wrote to memory of 2720	2456	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\90aeab9e0a122b390ea72287972b63bcbd22e981dada8b072b559ffc68f67635.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\90aeab9e0a122b390ea72287972b63bcbd22e981dada8b072b559ffc68f67635.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2720

memory/2720-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2720-1-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2720-2-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2720-3-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2720-4-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download