83fb7388f24a38256f4096c1a766c33d0d0e5e8bb4c5981fd1b376fba9f2da66

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:50

Target

83fb7388f24a38256f4096c1a766c33d0d0e5e8bb4c5981fd1b376fba9f2da66.dll
Size

76KB
MD5

747627c5c0b1f4183ac32d07fcde577a
SHA1

9e99534e9039875497c4d2dceae4ede9e84f022f
SHA256

83fb7388f24a38256f4096c1a766c33d0d0e5e8bb4c5981fd1b376fba9f2da66
SHA512

f98a6b728becc24e8278f65966184f0741045313c667eb7ba4593c8dbec3db104194464ab8016be3c5d7a5d7ee378c231770086231b02d925c9e8d5c8bb13e1a
SSDEEP

1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZgLBi:c8y93KQjy7G55riF1cMo034Bi

Score

9^/10

upx

UPX dump on OEP (original entry point) 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1744-0-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/1744-1-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1744-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1744-1-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1744 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rundll32.exe

description pid process

Token: SeDebugPrivilege 1744 rundll32.exe

pid	process
1744	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1744	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2088 wrote to memory of 1744	2088	rundll32.exe	rundll32.exe
PID 2088 wrote to memory of 1744	2088	rundll32.exe	rundll32.exe
PID 2088 wrote to memory of 1744	2088	rundll32.exe	rundll32.exe
PID 2088 wrote to memory of 1744	2088	rundll32.exe	rundll32.exe
PID 2088 wrote to memory of 1744	2088	rundll32.exe	rundll32.exe
PID 2088 wrote to memory of 1744	2088	rundll32.exe	rundll32.exe
PID 2088 wrote to memory of 1744	2088	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\83fb7388f24a38256f4096c1a766c33d0d0e5e8bb4c5981fd1b376fba9f2da66.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2088

memory/1744-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1744-1-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download