bee27eb92b05c26fe8b729601adb648334476b70f042d100f674ed0a8590ea1f

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 02:21

Target

bee27eb92b05c26fe8b729601adb648334476b70f042d100f674ed0a8590ea1f.dll
Size

76KB
MD5

f67f1704a5afe1c3663005e7d2f32355
SHA1

73ea7d592b2c93565cdd6c86c25da14c1e2f404d
SHA256

bee27eb92b05c26fe8b729601adb648334476b70f042d100f674ed0a8590ea1f
SHA512

7de857ae54f3d4dedf3f7941178344e06f6e815d8dc4d4513f9bd278d2e034f8aa672a790f205a5a357ee972159f71242a5abefee99f9adb1c3754b4855d6f9a
SSDEEP

1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7Z7S:c8y93KQjy7G55riF1cMo03tS

Score

9^/10

upx

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/5036-0-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/5036-1-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5036-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/5036-1-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2132	5036	WerFault.exe	84

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5036	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 5036	3004	rundll32.exe	84
PID 3004 wrote to memory of 5036	3004	rundll32.exe	84
PID 3004 wrote to memory of 5036	3004	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bee27eb92b05c26fe8b729601adb648334476b70f042d100f674ed0a8590ea1f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bee27eb92b05c26fe8b729601adb648334476b70f042d100f674ed0a8590ea1f.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 704
    3⤵
    - Program crash
    PID:2132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5036 -ip 5036
1⤵
PID:768

memory/5036-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5036-1-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download