b18801ae430d1623822ce1d6f933afa0ce04923493dfbab5050b5c591d9c9a77

Analysis

max time kernel
21s
max time network
24s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
17-04-2024 08:05

Target

62af787137b767867d12c2ebb767c41e.dll
Size

597KB
MD5

62af787137b767867d12c2ebb767c41e
SHA1

545065be052ed64f9158e9e80747fb8a744f94d9
SHA256

b18801ae430d1623822ce1d6f933afa0ce04923493dfbab5050b5c591d9c9a77
SHA512

e1484d2afb7b14a7f6ba89167c3d7e0749e167faa1f9301d1286b9de873401c43d66a48f5aa18fe17e1a1685cc18a0e30f16daf70e49cd8b80f2d3b85b2a1f80
SSDEEP

12288:2SdK4MVDr7vRgndOBBtggdMvk2CqvAmYac+MRGM4h/qofkKBw3:2Sd38r7ZgdOBHFt2CqvAic+MRGJ/qofO

Score

7^/10

upx

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000900000001ab73-3.dat	acprotect

Loads dropped DLL 2 IoCs

pid	Process
4956	rundll32.exe
4956	rundll32.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/files/0x000900000001ab73-3.dat	upx
behavioral2/memory/4956-6-0x0000000004CF0000-0x0000000004D23000-memory.dmp	upx
behavioral2/memory/4956-10-0x0000000004CF0000-0x0000000004D23000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4956	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 416 wrote to memory of 4956	416	rundll32.exe	74
PID 416 wrote to memory of 4956	416	rundll32.exe	74
PID 416 wrote to memory of 4956	416	rundll32.exe	74
PID 4956 wrote to memory of 4880	4956	rundll32.exe	75
PID 4956 wrote to memory of 4880	4956	rundll32.exe	75
PID 4956 wrote to memory of 4880	4956	rundll32.exe	75

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\62af787137b767867d12c2ebb767c41e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\62af787137b767867d12c2ebb767c41e.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Windows\SysWOW64\arp.exe
    arp -a
    3⤵
    PID:4880

\Program Files\Common Files\System\symsrv.dll

Filesize
71KB

MD5
4fcd7574537cebec8e75b4e646996643

SHA1
efa59bb9050fb656b90d5d40c942fb2a304f2a8b

SHA256
8ea3b17e4b783ffc0bc387b81b823bf87af0d57da74541d88ba85314bb232a5d

SHA512
7f1a7ef64d332a735db82506b47d84853af870785066d29ccaf4fdeab114079a9f0db400e01ba574776a0d652a248658fe1e8f9659cdced19ad6eea09644ea3e

Download Submit
memory/4956-6-0x0000000004CF0000-0x0000000004D23000-memory.dmp

Filesize
204KB

Download
memory/4956-9-0x0000000010000000-0x0000000010081000-memory.dmp

Filesize
516KB

Download
memory/4956-10-0x0000000004CF0000-0x0000000004D23000-memory.dmp

Filesize
204KB

Download
memory/4956-11-0x0000000010000000-0x0000000010081000-memory.dmp

Filesize
516KB

Download
memory/4956-7-0x0000000010000000-0x0000000010081000-memory.dmp

Filesize
516KB

Download
memory/4956-12-0x0000000010000000-0x0000000010081000-memory.dmp

Filesize
516KB

Download