Analysis
-
max time kernel
140s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/06/2024, 01:43
Behavioral task
behavioral1
Sample
ab4efbdce824f713d14298e2ed11f54d6ea3727c9c2b330719a21374e2002fdf.dll
Resource
win7-20240221-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
ab4efbdce824f713d14298e2ed11f54d6ea3727c9c2b330719a21374e2002fdf.dll
Resource
win10v2004-20240508-en
5 signatures
150 seconds
General
-
Target
ab4efbdce824f713d14298e2ed11f54d6ea3727c9c2b330719a21374e2002fdf.dll
-
Size
76KB
-
MD5
73ef561e21958e75bce57d7ff9a9ba32
-
SHA1
f332895e7ee6ab121487922fd7ffe3f6f6916ad0
-
SHA256
ab4efbdce824f713d14298e2ed11f54d6ea3727c9c2b330719a21374e2002fdf
-
SHA512
934721fbfd7fcff8f6189027bfd8d47eab3114e3dc30c0ee18c20a8864207034c0beffbbbaa7b8a3a740885ac0ed7a915284dda0dcd4470ce35bba029ca2fa85
-
SSDEEP
1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZE+D:c8y93KQjy7G55riF1cMo031
Score
9/10
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral1/memory/1196-0-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/1196-7-0x0000000010000000-0x0000000010030000-memory.dmp UPX -
resource yara_rule behavioral1/memory/1196-0-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1196-7-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 1956 1196 WerFault.exe 28 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1196 rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2304 wrote to memory of 1196 2304 rundll32.exe 28 PID 2304 wrote to memory of 1196 2304 rundll32.exe 28 PID 2304 wrote to memory of 1196 2304 rundll32.exe 28 PID 2304 wrote to memory of 1196 2304 rundll32.exe 28 PID 2304 wrote to memory of 1196 2304 rundll32.exe 28 PID 2304 wrote to memory of 1196 2304 rundll32.exe 28 PID 2304 wrote to memory of 1196 2304 rundll32.exe 28 PID 1196 wrote to memory of 1956 1196 rundll32.exe 29 PID 1196 wrote to memory of 1956 1196 rundll32.exe 29 PID 1196 wrote to memory of 1956 1196 rundll32.exe 29 PID 1196 wrote to memory of 1956 1196 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ab4efbdce824f713d14298e2ed11f54d6ea3727c9c2b330719a21374e2002fdf.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ab4efbdce824f713d14298e2ed11f54d6ea3727c9c2b330719a21374e2002fdf.dll,#12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 3083⤵
- Program crash
PID:1956
-
-