90aeab9e0a122b390ea72287972b63bcbd22e981dada8b072b559ffc68f67635

Analysis

max time kernel
142s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 21:27

Target

90aeab9e0a122b390ea72287972b63bcbd22e981dada8b072b559ffc68f67635.dll
Size

76KB
MD5

b293c36400c7a64853e85db995fe676c
SHA1

f693a48ca4cd08fb2c6c381e3fe551a3896f4511
SHA256

90aeab9e0a122b390ea72287972b63bcbd22e981dada8b072b559ffc68f67635
SHA512

fcb6d48228d20922da838acc2358791d0d7261d5cf072a916f757e0aec9ed2a1d7513849ad2e7ba99f480f8f03850171d9b4e12b81eccdc3e59845b14f8fd08b
SSDEEP

1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZNiiDVjtAR:c8y93KQjy7G55riF1cMo03PiiDVjtAR

Score

9^/10

upx

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/956-0-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/956-1-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/956-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/956-1-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
440	956	WerFault.exe	88

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	956	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 956	828	rundll32.exe	88
PID 828 wrote to memory of 956	828	rundll32.exe	88
PID 828 wrote to memory of 956	828	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\90aeab9e0a122b390ea72287972b63bcbd22e981dada8b072b559ffc68f67635.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\90aeab9e0a122b390ea72287972b63bcbd22e981dada8b072b559ffc68f67635.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 700
    3⤵
    - Program crash
    PID:440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 956 -ip 956
1⤵
PID:60

memory/956-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/956-1-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download