4177bcf389abc1c0bf3447e22fc2706d129e0eec06b0b2bfc8c77698f8e70d56

Analysis

max time kernel
140s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 21:35

Target

4177bcf389abc1c0bf3447e22fc2706d129e0eec06b0b2bfc8c77698f8e70d56.dll
Size

76KB
MD5

a6a50162a40b418085b5a7f91ba03430
SHA1

385628837fd82eb5d5443fd9aa56d0f0b6c276ee
SHA256

4177bcf389abc1c0bf3447e22fc2706d129e0eec06b0b2bfc8c77698f8e70d56
SHA512

0c8fdb99b1d472a76a483d1a82f5403798993d78748409e05f45b7939ec1b020866e5625465d454691287380fc67ca46d6c2d2f4054d6043aad57e7393baa51d
SSDEEP

1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZUZ2lm:c8y93KQjy7G55riF1cMo03qZ2A

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4804-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4804-1-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

4804 rundll32.exe
4804 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rundll32.exe

description pid process

Token: SeDebugPrivilege 4804 rundll32.exe

pid	process
4804	rundll32.exe
4804	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	4804	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4448 wrote to memory of 4804	4448	rundll32.exe	rundll32.exe
PID 4448 wrote to memory of 4804	4448	rundll32.exe	rundll32.exe
PID 4448 wrote to memory of 4804	4448	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4177bcf389abc1c0bf3447e22fc2706d129e0eec06b0b2bfc8c77698f8e70d56.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4177bcf389abc1c0bf3447e22fc2706d129e0eec06b0b2bfc8c77698f8e70d56.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4804

memory/4804-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4804-1-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download