988f5cc56caf26115f78a50166cac0dd7724d11a2501f04bafc263d57b86e34f

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 16:20

Target

$PLUGINSDIR/SelfDel.dll
Size

5KB
MD5

ca8bcdded6b265453cf68bae8bbd0b3a
SHA1

9dbe872ac53e075c0954c882d034aa009c733092
SHA256

299ba97dda721cc9216bda218769eb269a239c8bcf09bd6acc774ff935849184
SHA512

a9b19434c35236a049036f0153a5c7184c95249fdb04ef7605484551d40a8aba37462eb617e96301cd4363a324f0282e26179ce4b78973ca43e0a63b4dffb33c
SSDEEP

48:S17Ql+sbsjAowLVEq1y58vzWLDjjZSeJY8JTaTIUNEyTFS7lr0zsBEaSujrt6EQD:v8sgYLVEX4zwjINxS7xg+TScrQD

Score

7^/10

upx

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
behavioral5/memory/1676-0-0x0000000074620000-0x0000000074629000-memory.dmp	acprotect
behavioral5/memory/1676-3-0x0000000074620000-0x0000000074629000-memory.dmp	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral5/memory/1676-0-0x0000000074620000-0x0000000074629000-memory.dmp	upx
behavioral5/memory/1676-3-0x0000000074620000-0x0000000074629000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2460 1676 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2460	1676	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2264 wrote to memory of 1676	2264	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 1676	2264	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 1676	2264	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 1676	2264	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 1676	2264	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 1676	2264	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 1676	2264	rundll32.exe	rundll32.exe
PID 1676 wrote to memory of 2460	1676	rundll32.exe	WerFault.exe
PID 1676 wrote to memory of 2460	1676	rundll32.exe	WerFault.exe
PID 1676 wrote to memory of 2460	1676	rundll32.exe	WerFault.exe
PID 1676 wrote to memory of 2460	1676	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2264

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 220
3⤵
- Program crash
PID:2460

memory/1676-2-0x0000000074610000-0x0000000074619000-memory.dmp

Filesize
36KB

Download
memory/1676-1-0x0000000074600000-0x0000000074609000-memory.dmp

Filesize
36KB

Download
memory/1676-0-0x0000000074620000-0x0000000074629000-memory.dmp

Filesize
36KB

Download
memory/1676-3-0x0000000074620000-0x0000000074629000-memory.dmp

Filesize
36KB

Download
memory/1676-5-0x0000000074600000-0x0000000074609000-memory.dmp

Filesize
36KB

Download
memory/1676-6-0x0000000074610000-0x0000000074619000-memory.dmp

Filesize
36KB

Download