72f5801275fee189ef50b2754a0b164efce455823c59cf06e9934d193d6dfb20

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 23:25

Target

72f5801275fee189ef50b2754a0b164efce455823c59cf06e9934d193d6dfb20.dll
Size

76KB
MD5

37dd106b7baa14dd5acf0cbd4f59ff52
SHA1

d9b5044e6f0a8471a89ad4c4283567e46c37c323
SHA256

72f5801275fee189ef50b2754a0b164efce455823c59cf06e9934d193d6dfb20
SHA512

938d7a32570e44a4973e0ffd717fea6d6fc347a64e3fd6675a0f588e8747b78fcc551e62881ad06392adbfe64cc563288d6f39c2e2a6b92b6cc7bc3a541edb30
SSDEEP

1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZHOV:c8y93KQjy7G55riF1cMo03BOV

Score

9^/10

upx

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/4596-0-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4596-1-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4596-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4596-1-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3876	4596	WerFault.exe	86

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4596	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 4596	1988	rundll32.exe	86
PID 1988 wrote to memory of 4596	1988	rundll32.exe	86
PID 1988 wrote to memory of 4596	1988	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\72f5801275fee189ef50b2754a0b164efce455823c59cf06e9934d193d6dfb20.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\72f5801275fee189ef50b2754a0b164efce455823c59cf06e9934d193d6dfb20.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4596
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4596 -s 716
    3⤵
    - Program crash
    PID:3876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4596 -ip 4596
1⤵
PID:4988

memory/4596-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4596-1-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download