Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-04-2024 20:04
Behavioral task
behavioral1
Sample
261be99dfe0c6e519d254fcc79ab5932eff4a9aacf41101825dc65ed8c64a5b3.dll
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
261be99dfe0c6e519d254fcc79ab5932eff4a9aacf41101825dc65ed8c64a5b3.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
261be99dfe0c6e519d254fcc79ab5932eff4a9aacf41101825dc65ed8c64a5b3.dll
-
Size
76KB
-
MD5
8bd9dad1b4c848dadca8aee75df0cb78
-
SHA1
336c326fdea7238a2860096e5608e92ae29b6474
-
SHA256
261be99dfe0c6e519d254fcc79ab5932eff4a9aacf41101825dc65ed8c64a5b3
-
SHA512
efe76e1293d7a5f44f64d33ded856f8fddf170c417e6c2153f189c4117f397fc64885638275865b3cfca216114fa5625a5ed32015071910ed01289ba9bf625ea
-
SSDEEP
1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7Z6n/aQjatFt:c8y93KQjy7G55riF1cMo03i/aKavt
Score
9/10
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral1/memory/2056-0-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/2056-1-0x0000000010000000-0x0000000010030000-memory.dmp UPX -
Modifies AppInit DLL entries 2 TTPs
-
resource yara_rule behavioral1/memory/2056-0-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2056-1-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 2196 2056 WerFault.exe 28 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2056 rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2004 wrote to memory of 2056 2004 rundll32.exe 28 PID 2004 wrote to memory of 2056 2004 rundll32.exe 28 PID 2004 wrote to memory of 2056 2004 rundll32.exe 28 PID 2004 wrote to memory of 2056 2004 rundll32.exe 28 PID 2004 wrote to memory of 2056 2004 rundll32.exe 28 PID 2004 wrote to memory of 2056 2004 rundll32.exe 28 PID 2004 wrote to memory of 2056 2004 rundll32.exe 28 PID 2056 wrote to memory of 2196 2056 rundll32.exe 29 PID 2056 wrote to memory of 2196 2056 rundll32.exe 29 PID 2056 wrote to memory of 2196 2056 rundll32.exe 29 PID 2056 wrote to memory of 2196 2056 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\261be99dfe0c6e519d254fcc79ab5932eff4a9aacf41101825dc65ed8c64a5b3.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\261be99dfe0c6e519d254fcc79ab5932eff4a9aacf41101825dc65ed8c64a5b3.dll,#12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 2683⤵
- Program crash
PID:2196
-
-