a11544629ef86f8e53964ab7157357b7975f902359f409a63942b3fca3fc7138

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 00:32

Target

a11544629ef86f8e53964ab7157357b7975f902359f409a63942b3fca3fc7138.dll
Size

76KB
MD5

ffb8844708276076a1e4d5d8bfebae79
SHA1

d68f86d68a8450507437caa90324848081abd5ac
SHA256

a11544629ef86f8e53964ab7157357b7975f902359f409a63942b3fca3fc7138
SHA512

f2cd1d6bb17f3fa3271c0664510f039acf11842d1149239cfc19c5e5aad669ff3f86584682cc7dc6d6203d08967e23050ea8e40e698ab65d2d219a284220623b
SSDEEP

1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7Z7Yek:c8y93KQjy7G55riF1cMo03Cek

Score

9^/10

upx

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral1/memory/2192-0-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/2192-7-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2192-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2192-7-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1960	2192	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2192	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2192	2896	rundll32.exe	28
PID 2896 wrote to memory of 2192	2896	rundll32.exe	28
PID 2896 wrote to memory of 2192	2896	rundll32.exe	28
PID 2896 wrote to memory of 2192	2896	rundll32.exe	28
PID 2896 wrote to memory of 2192	2896	rundll32.exe	28
PID 2896 wrote to memory of 2192	2896	rundll32.exe	28
PID 2896 wrote to memory of 2192	2896	rundll32.exe	28
PID 2192 wrote to memory of 1960	2192	rundll32.exe	29
PID 2192 wrote to memory of 1960	2192	rundll32.exe	29
PID 2192 wrote to memory of 1960	2192	rundll32.exe	29
PID 2192 wrote to memory of 1960	2192	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a11544629ef86f8e53964ab7157357b7975f902359f409a63942b3fca3fc7138.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a11544629ef86f8e53964ab7157357b7975f902359f409a63942b3fca3fc7138.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 324
    3⤵
    - Program crash
    PID:1960

memory/2192-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2192-1-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2192-7-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download