3f4ed9739964f8c84a11bf1b9407a6317d8962e4abc2a85569f91a4469648979

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 20:53

Target

3f4ed9739964f8c84a11bf1b9407a6317d8962e4abc2a85569f91a4469648979.dll
Size

76KB
MD5

ec254ca84b3cc129522dbd1ac0ee9837
SHA1

66c2605e56c7ef128d003f82f6089f9e7e734bb1
SHA256

3f4ed9739964f8c84a11bf1b9407a6317d8962e4abc2a85569f91a4469648979
SHA512

f63e6e23dfc9a6eecce27bb62ebfe745fd6b8763209c78d19f3dc4c784f552b12d652b1401da29929b0dbaf48db3b51c771b24439fdb30360b5321c47753d183
SSDEEP

1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7Zf8ra:c8y93KQjy7G55riF1cMo030a

Score

9^/10

upx

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral1/memory/2180-0-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/2180-1-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2180-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2180-1-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
348	2180	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2180	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2180	2364	rundll32.exe	28
PID 2364 wrote to memory of 2180	2364	rundll32.exe	28
PID 2364 wrote to memory of 2180	2364	rundll32.exe	28
PID 2364 wrote to memory of 2180	2364	rundll32.exe	28
PID 2364 wrote to memory of 2180	2364	rundll32.exe	28
PID 2364 wrote to memory of 2180	2364	rundll32.exe	28
PID 2364 wrote to memory of 2180	2364	rundll32.exe	28
PID 2180 wrote to memory of 348	2180	rundll32.exe	29
PID 2180 wrote to memory of 348	2180	rundll32.exe	29
PID 2180 wrote to memory of 348	2180	rundll32.exe	29
PID 2180 wrote to memory of 348	2180	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f4ed9739964f8c84a11bf1b9407a6317d8962e4abc2a85569f91a4469648979.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f4ed9739964f8c84a11bf1b9407a6317d8962e4abc2a85569f91a4469648979.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 336
    3⤵
    - Program crash
    PID:348

memory/2180-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2180-1-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download