165da02d6d09dda64442129d350c4c27d3a51e052c26e7c1f36b00dbbcf7fba1

Analysis

max time kernel
139s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 18:58

Target

165da02d6d09dda64442129d350c4c27d3a51e052c26e7c1f36b00dbbcf7fba1.dll
Size

76KB
MD5

d2205918ac0f6efb9d200015d03c3271
SHA1

3ab658090ce3afed6945725b8f20e33066379330
SHA256

165da02d6d09dda64442129d350c4c27d3a51e052c26e7c1f36b00dbbcf7fba1
SHA512

05c644b4161d59aae69cca76cb411880be0bfe3304cb291f91ea4416dcc38ea6425f4960e0d2bcdd9ca337a1065ba7f96fcc7ffdc9d135b21ac73bd8d1d97900
SSDEEP

1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZP:c8y93KQjy7G55riF1cMo03x

Score

9^/10

upx

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/3480-0-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/3480-2-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3480-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3480-2-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3592	3480	WerFault.exe	82

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3480	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 3480	1332	rundll32.exe	82
PID 1332 wrote to memory of 3480	1332	rundll32.exe	82
PID 1332 wrote to memory of 3480	1332	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\165da02d6d09dda64442129d350c4c27d3a51e052c26e7c1f36b00dbbcf7fba1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\165da02d6d09dda64442129d350c4c27d3a51e052c26e7c1f36b00dbbcf7fba1.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 712
    3⤵
    - Program crash
    PID:3592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3480 -ip 3480
1⤵
PID:3360

memory/3480-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3480-2-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download