a3ae4570ea79edca6be2b632e73f6377d254205fc88dc0d0d0251a13dcfd7749

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:18

Target

a3ae4570ea79edca6be2b632e73f6377d254205fc88dc0d0d0251a13dcfd7749.dll
Size

142KB
MD5

372a395d15556063fe723a7d25b5d2e8
SHA1

67b55d03ca5f3db23fa6521afdf34a9022c33af1
SHA256

a3ae4570ea79edca6be2b632e73f6377d254205fc88dc0d0d0251a13dcfd7749
SHA512

df89847f4a95857048eaec373a6d632eb472bdc7306467977ac84fc1ee4d17b38dced1bf7e1b34ebdd80f6b7537441f73751f13399f620fc89f7e107a3896a7d
SSDEEP

3072:9cwO/iTOdgWtJwrudmurEaMWgcVQPqJWhMAXNEzpDKQsojV2XI:9DTOdgWtOrudmux2yU/9ExJjgY

Score

9^/10

upx

UPX dump on OEP (original entry point) 2 IoCs

Processes:

resource	yara_rule
C:\Windows\SysWOW64\rundll32mgr.exe	UPX
behavioral2/memory/4352-8-0x0000000000400000-0x000000000045B000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

Processes:

rundll32mgr.exe

pid process

4352 rundll32mgr.exe

pid	process
4352	rundll32mgr.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
C:\Windows\SysWOW64\rundll32mgr.exe	upx
behavioral2/memory/4352-8-0x0000000000400000-0x000000000045B000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4780 4352 WerFault.exe rundll32mgr.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rundll32.exe

description pid process

Token: SeDebugPrivilege 3972 rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

pid	pid_target	process	target process
4780	4352	WerFault.exe	rundll32mgr.exe

description	pid	process
Token: SeDebugPrivilege	3972	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4188 wrote to memory of 3972	4188	rundll32.exe	rundll32.exe
PID 4188 wrote to memory of 3972	4188	rundll32.exe	rundll32.exe
PID 4188 wrote to memory of 3972	4188	rundll32.exe	rundll32.exe
PID 3972 wrote to memory of 4352	3972	rundll32.exe	rundll32mgr.exe
PID 3972 wrote to memory of 4352	3972	rundll32.exe	rundll32mgr.exe
PID 3972 wrote to memory of 4352	3972	rundll32.exe	rundll32mgr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3ae4570ea79edca6be2b632e73f6377d254205fc88dc0d0d0251a13dcfd7749.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4188

C:\Windows\SysWOW64\rundll32mgr.exe
C:\Windows\SysWOW64\rundll32mgr.exe
3⤵
- Executes dropped EXE
PID:4352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 264
4⤵
- Program crash
PID:4780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4352 -ip 4352
1⤵
PID:1572

C:\Windows\SysWOW64\rundll32mgr.exe
Filesize
105KB

MD5
dfb5daabb95dcfad1a5faf9ab1437076

SHA1
4a199569a9b52911bee7fb19ab80570cc5ff9ed1

SHA256
54282ec29d4993ed6e9972122cfbb70bba4898a21d527bd9e72a166d7ec2fdc0

SHA512
5d31c34403ab5f8db4a6d84f2b5579d4ea18673914b626d78e458a648ac20ddd8e342818e807331036d7bb064f596a02b9737acac42fbead29260343a30717e8

Download Submit
memory/3972-1-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download
memory/3972-9-0x00000000779B2000-0x00000000779B3000-memory.dmp

Filesize
4KB

Download
memory/3972-7-0x0000000000C40000-0x0000000000C41000-memory.dmp

Filesize
4KB

Download
memory/3972-6-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/3972-4-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/3972-12-0x00000000779B2000-0x00000000779B3000-memory.dmp

Filesize
4KB

Download
memory/4352-10-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/4352-8-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download