4245b59eb49f9ea2596ed1791ea2c81173acbfdfa2ceaf8e17ab418ace71d847

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-06-2024 18:10

Target

$PLUGINSDIR/SelfDel.dll
Size

5KB
MD5

ca8bcdded6b265453cf68bae8bbd0b3a
SHA1

9dbe872ac53e075c0954c882d034aa009c733092
SHA256

299ba97dda721cc9216bda218769eb269a239c8bcf09bd6acc774ff935849184
SHA512

a9b19434c35236a049036f0153a5c7184c95249fdb04ef7605484551d40a8aba37462eb617e96301cd4363a324f0282e26179ce4b78973ca43e0a63b4dffb33c
SSDEEP

48:S17Ql+sbsjAowLVEq1y58vzWLDjjZSeJY8JTaTIUNEyTFS7lr0zsBEaSujrt6EQD:v8sgYLVEX4zwjINxS7xg+TScrQD

Score

7^/10

upx

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral7/memory/2740-3-0x00000000751B0000-0x00000000751B9000-memory.dmp	acprotect
behavioral7/memory/2740-4-0x00000000751B0000-0x00000000751B9000-memory.dmp	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral7/memory/2740-3-0x00000000751B0000-0x00000000751B9000-memory.dmp	upx
behavioral7/memory/2740-4-0x00000000751B0000-0x00000000751B9000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1680	2740	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2740	2088	rundll32.exe	28
PID 2088 wrote to memory of 2740	2088	rundll32.exe	28
PID 2088 wrote to memory of 2740	2088	rundll32.exe	28
PID 2088 wrote to memory of 2740	2088	rundll32.exe	28
PID 2088 wrote to memory of 2740	2088	rundll32.exe	28
PID 2088 wrote to memory of 2740	2088	rundll32.exe	28
PID 2088 wrote to memory of 2740	2088	rundll32.exe	28
PID 2740 wrote to memory of 1680	2740	rundll32.exe	29
PID 2740 wrote to memory of 1680	2740	rundll32.exe	29
PID 2740 wrote to memory of 1680	2740	rundll32.exe	29
PID 2740 wrote to memory of 1680	2740	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 220
    3⤵
    - Program crash
    PID:1680

memory/2740-0-0x00000000751B0000-0x00000000751B9000-memory.dmp

Filesize
36KB

Download
memory/2740-3-0x00000000751B0000-0x00000000751B9000-memory.dmp

Filesize
36KB

Download
memory/2740-2-0x00000000751A0000-0x00000000751A9000-memory.dmp

Filesize
36KB

Download
memory/2740-1-0x00000000751C0000-0x00000000751C9000-memory.dmp

Filesize
36KB

Download
memory/2740-4-0x00000000751B0000-0x00000000751B9000-memory.dmp

Filesize
36KB

Download
memory/2740-5-0x00000000751C0000-0x00000000751C9000-memory.dmp

Filesize
36KB

Download
memory/2740-7-0x00000000751A0000-0x00000000751A9000-memory.dmp

Filesize
36KB

Download