ae69ee2a8f9344379b09e7c2e432276c1513c0d315cbf4134bdcc2655a9007c0

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 01:49

Target

ae69ee2a8f9344379b09e7c2e432276c1513c0d315cbf4134bdcc2655a9007c0.dll
Size

76KB
MD5

064812d49560bb9367629f3856919c36
SHA1

cb8f0d9706566f444e5ab0be385f7bf084628d8c
SHA256

ae69ee2a8f9344379b09e7c2e432276c1513c0d315cbf4134bdcc2655a9007c0
SHA512

7b5cec9f14c7f7bacdaaccdfed71323984763233c41c501ea80c514c1f984ee069906009462984038eba03bfa4126c8c2fe94ed2d816950e8368ecec8f72018d
SSDEEP

1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZrtVaSv/:c8y93KQjy7G55riF1cMo03LLH

Score

9^/10

upx

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/5088-0-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/5088-1-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5088-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/5088-1-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3316	5088	WerFault.exe	85

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5088	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 5088	1344	rundll32.exe	85
PID 1344 wrote to memory of 5088	1344	rundll32.exe	85
PID 1344 wrote to memory of 5088	1344	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae69ee2a8f9344379b09e7c2e432276c1513c0d315cbf4134bdcc2655a9007c0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae69ee2a8f9344379b09e7c2e432276c1513c0d315cbf4134bdcc2655a9007c0.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 692
    3⤵
    - Program crash
    PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5088 -ip 5088
1⤵
PID:1004

memory/5088-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5088-1-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download