ae69ee2a8f9344379b09e7c2e432276c1513c0d315cbf4134bdcc2655a9007c0

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 01:49

Target

ae69ee2a8f9344379b09e7c2e432276c1513c0d315cbf4134bdcc2655a9007c0.dll
Size

76KB
MD5

064812d49560bb9367629f3856919c36
SHA1

cb8f0d9706566f444e5ab0be385f7bf084628d8c
SHA256

ae69ee2a8f9344379b09e7c2e432276c1513c0d315cbf4134bdcc2655a9007c0
SHA512

7b5cec9f14c7f7bacdaaccdfed71323984763233c41c501ea80c514c1f984ee069906009462984038eba03bfa4126c8c2fe94ed2d816950e8368ecec8f72018d
SSDEEP

1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZrtVaSv/:c8y93KQjy7G55riF1cMo03LLH

Score

9^/10

upx

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral1/memory/1640-1-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/1640-0-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1640-1-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1640-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1692	1640	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1640	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 1640	2164	rundll32.exe	28
PID 2164 wrote to memory of 1640	2164	rundll32.exe	28
PID 2164 wrote to memory of 1640	2164	rundll32.exe	28
PID 2164 wrote to memory of 1640	2164	rundll32.exe	28
PID 2164 wrote to memory of 1640	2164	rundll32.exe	28
PID 2164 wrote to memory of 1640	2164	rundll32.exe	28
PID 2164 wrote to memory of 1640	2164	rundll32.exe	28
PID 1640 wrote to memory of 1692	1640	rundll32.exe	29
PID 1640 wrote to memory of 1692	1640	rundll32.exe	29
PID 1640 wrote to memory of 1692	1640	rundll32.exe	29
PID 1640 wrote to memory of 1692	1640	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae69ee2a8f9344379b09e7c2e432276c1513c0d315cbf4134bdcc2655a9007c0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae69ee2a8f9344379b09e7c2e432276c1513c0d315cbf4134bdcc2655a9007c0.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 312
    3⤵
    - Program crash
    PID:1692

memory/1640-1-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1640-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download