988f5cc56caf26115f78a50166cac0dd7724d11a2501f04bafc263d57b86e34f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 16:20

Target

$PLUGINSDIR/SelfDel.dll
Size

5KB
MD5

ca8bcdded6b265453cf68bae8bbd0b3a
SHA1

9dbe872ac53e075c0954c882d034aa009c733092
SHA256

299ba97dda721cc9216bda218769eb269a239c8bcf09bd6acc774ff935849184
SHA512

a9b19434c35236a049036f0153a5c7184c95249fdb04ef7605484551d40a8aba37462eb617e96301cd4363a324f0282e26179ce4b78973ca43e0a63b4dffb33c
SSDEEP

48:S17Ql+sbsjAowLVEq1y58vzWLDjjZSeJY8JTaTIUNEyTFS7lr0zsBEaSujrt6EQD:v8sgYLVEX4zwjINxS7xg+TScrQD

Score

7^/10

upx

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
behavioral6/memory/2164-0-0x00000000754D0000-0x00000000754D9000-memory.dmp	acprotect
behavioral6/memory/2164-2-0x00000000754D0000-0x00000000754D9000-memory.dmp	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral6/memory/2164-0-0x00000000754D0000-0x00000000754D9000-memory.dmp	upx
behavioral6/memory/2164-2-0x00000000754D0000-0x00000000754D9000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4972 2164 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4972	2164	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3352 wrote to memory of 2164	3352	rundll32.exe	rundll32.exe
PID 3352 wrote to memory of 2164	3352	rundll32.exe	rundll32.exe
PID 3352 wrote to memory of 2164	3352	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3352

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1
2⤵
PID:2164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 612
3⤵
- Program crash
PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2164 -ip 2164
1⤵
PID:2180

memory/2164-0-0x00000000754D0000-0x00000000754D9000-memory.dmp

Filesize
36KB

Download
memory/2164-2-0x00000000754D0000-0x00000000754D9000-memory.dmp

Filesize
36KB

Download