4245b59eb49f9ea2596ed1791ea2c81173acbfdfa2ceaf8e17ab418ace71d847

Analysis

max time kernel
146s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
18/06/2024, 14:23

Target

$PLUGINSDIR/SelfDel.dll
Size

5KB
MD5

ca8bcdded6b265453cf68bae8bbd0b3a
SHA1

9dbe872ac53e075c0954c882d034aa009c733092
SHA256

299ba97dda721cc9216bda218769eb269a239c8bcf09bd6acc774ff935849184
SHA512

a9b19434c35236a049036f0153a5c7184c95249fdb04ef7605484551d40a8aba37462eb617e96301cd4363a324f0282e26179ce4b78973ca43e0a63b4dffb33c
SSDEEP

48:S17Ql+sbsjAowLVEq1y58vzWLDjjZSeJY8JTaTIUNEyTFS7lr0zsBEaSujrt6EQD:v8sgYLVEX4zwjINxS7xg+TScrQD

Score

7^/10

upx

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral4/memory/3392-0-0x0000000075110000-0x0000000075119000-memory.dmp	acprotect
behavioral4/memory/3392-1-0x0000000075110000-0x0000000075119000-memory.dmp	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral4/memory/3392-0-0x0000000075110000-0x0000000075119000-memory.dmp	upx
behavioral4/memory/3392-1-0x0000000075110000-0x0000000075119000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1604	3392	WerFault.exe	77

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 3392	1664	rundll32.exe	77
PID 1664 wrote to memory of 3392	1664	rundll32.exe	77
PID 1664 wrote to memory of 3392	1664	rundll32.exe	77

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1
  2⤵
  PID:3392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 468
    3⤵
    - Program crash
    PID:1604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3392 -ip 3392
1⤵
PID:3220

memory/3392-0-0x0000000075110000-0x0000000075119000-memory.dmp

Filesize
36KB

Download
memory/3392-1-0x0000000075110000-0x0000000075119000-memory.dmp

Filesize
36KB

Download