92d49450a42badbc8341e153cc752eb2e767547d3e81acaf4458c054d8abd252

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 03:15

Target

92d49450a42badbc8341e153cc752eb2e767547d3e81acaf4458c054d8abd252.dll
Size

76KB
MD5

8a436fa52f760ab9ce99589f3e1d94c8
SHA1

211dffd6b3a00a0442d6d1d505d4435701a2fc4c
SHA256

92d49450a42badbc8341e153cc752eb2e767547d3e81acaf4458c054d8abd252
SHA512

e5bf0a6033ec1771746c2351a25d03866f09264aaed91fd67d7b787be7f72c7b8c46947da0187f27426a27b704286ec09f2dc174cd42ed9967ab27b112931bac
SSDEEP

1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZR3j:c8y93KQjy7G55riF1cMo03v3j

Score

9^/10

upx

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2388-1-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/2388-2-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/2388-0-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/2388-3-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/2388-1-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2388-2-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2388-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2388-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

2388 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rundll32.exe

description pid process

Token: SeDebugPrivilege 2388 rundll32.exe

pid	process
2388	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	2388	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2148 wrote to memory of 2388	2148	rundll32.exe	rundll32.exe
PID 2148 wrote to memory of 2388	2148	rundll32.exe	rundll32.exe
PID 2148 wrote to memory of 2388	2148	rundll32.exe	rundll32.exe
PID 2148 wrote to memory of 2388	2148	rundll32.exe	rundll32.exe
PID 2148 wrote to memory of 2388	2148	rundll32.exe	rundll32.exe
PID 2148 wrote to memory of 2388	2148	rundll32.exe	rundll32.exe
PID 2148 wrote to memory of 2388	2148	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92d49450a42badbc8341e153cc752eb2e767547d3e81acaf4458c054d8abd252.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2148

memory/2388-1-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2388-2-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2388-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2388-3-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download