349419912a66aaec9a4dea2951c8871924c3aeef4426ae3cc074b5b43648ecbc

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 21:13

Target

349419912a66aaec9a4dea2951c8871924c3aeef4426ae3cc074b5b43648ecbc.dll
Size

76KB
MD5

736ed872e873a03e63ef8adc0e4ec84f
SHA1

2ec9bf6dc1f0d503405456549207b1058831ff28
SHA256

349419912a66aaec9a4dea2951c8871924c3aeef4426ae3cc074b5b43648ecbc
SHA512

7b34fd4c5c3112b1ca7e662b099c6e7d986a940a9b05d6c6ef939182a089181da694d70dc292cf60fca4b3b3e444eb877e5459302575173f3cb8138e650a6e86
SSDEEP

1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7Z5kWqNhw4/Z5:c8y93KQjy7G55riF1cMo03zIxZ5

Score

9^/10

upx

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral1/memory/1524-0-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/1524-1-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/1524-2-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1524-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1524-1-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1524-2-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2188	1524	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1524	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 1524	1556	rundll32.exe	28
PID 1556 wrote to memory of 1524	1556	rundll32.exe	28
PID 1556 wrote to memory of 1524	1556	rundll32.exe	28
PID 1556 wrote to memory of 1524	1556	rundll32.exe	28
PID 1556 wrote to memory of 1524	1556	rundll32.exe	28
PID 1556 wrote to memory of 1524	1556	rundll32.exe	28
PID 1556 wrote to memory of 1524	1556	rundll32.exe	28
PID 1524 wrote to memory of 2188	1524	rundll32.exe	29
PID 1524 wrote to memory of 2188	1524	rundll32.exe	29
PID 1524 wrote to memory of 2188	1524	rundll32.exe	29
PID 1524 wrote to memory of 2188	1524	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\349419912a66aaec9a4dea2951c8871924c3aeef4426ae3cc074b5b43648ecbc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\349419912a66aaec9a4dea2951c8871924c3aeef4426ae3cc074b5b43648ecbc.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 308
    3⤵
    - Program crash
    PID:2188

memory/1524-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1524-1-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1524-2-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download