0d5d0a7acd5f94c95d0e0d71e5581bdd92fa465baadce7c782319035e5059f77

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 02:43

Target

iccscbn.dll
Size

126KB
MD5

04c229ac6205d0109abec916d8da4797
SHA1

25acfa2630846ac082b9f3bb58bccdf4ebccdc72
SHA256

a057bd7a69f66166cb15c99429c91fdd7c36846e211e531361b413a0f03a5a92
SHA512

3c54d68ca0ab41796dadcb4bb63721cd73d81b2f09a5a59e8fa7d1a13b3444816d0281f618bf586f423d730485061e2d3974070a86d67fb363d0cfc297f953d0
SSDEEP

3072:a16h4ITEPMs6XEkF62evWfg42hmm7y/0dayxoeW:O6GIls6Ew1hI42p7ywoe

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral15/memory/316-6-0x0000000000170000-0x00000000001DC000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	316	rundll32.exe
Token: SeDebugPrivilege	316	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 316	2232	rundll32.exe	28
PID 2232 wrote to memory of 316	2232	rundll32.exe	28
PID 2232 wrote to memory of 316	2232	rundll32.exe	28
PID 2232 wrote to memory of 316	2232	rundll32.exe	28
PID 2232 wrote to memory of 316	2232	rundll32.exe	28
PID 2232 wrote to memory of 316	2232	rundll32.exe	28
PID 2232 wrote to memory of 316	2232	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\iccscbn.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\iccscbn.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:316

C:\Users\Admin\AppData\Local\Temp\__log.txt

Filesize
395B

MD5
136147435c7fdea3a05fb26fe133129a

SHA1
5c8bdcb23b093cc0cc45bc57df42d6d0b51e62aa

SHA256
fa76c3884d5f8f26e52e2d1d00086dfbcdc1e9b419dc4b4e2e01054074708c40

SHA512
c41c52da63b4f70924c74fbb9ccf643aeac135c487595adff429a30a59a3586f470e6f7361caf0f840a46eeffe17954c57664265b35525db58e1a0e2b017a545

Download Submit
memory/316-6-0x0000000000170000-0x00000000001DC000-memory.dmp

Filesize
432KB

Download
memory/316-5-0x0000000000160000-0x00000000001CC000-memory.dmp

Filesize
432KB

Download
memory/316-4-0x0000000000160000-0x00000000001CC000-memory.dmp

Filesize
432KB

Download
memory/316-3-0x0000000000160000-0x00000000001CC000-memory.dmp

Filesize
432KB

Download