4245b59eb49f9ea2596ed1791ea2c81173acbfdfa2ceaf8e17ab418ace71d847

Analysis

max time kernel
139s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
22/06/2024, 18:10

Target

$PLUGINSDIR/SelfDel.dll
Size

5KB
MD5

ca8bcdded6b265453cf68bae8bbd0b3a
SHA1

9dbe872ac53e075c0954c882d034aa009c733092
SHA256

299ba97dda721cc9216bda218769eb269a239c8bcf09bd6acc774ff935849184
SHA512

a9b19434c35236a049036f0153a5c7184c95249fdb04ef7605484551d40a8aba37462eb617e96301cd4363a324f0282e26179ce4b78973ca43e0a63b4dffb33c
SSDEEP

48:S17Ql+sbsjAowLVEq1y58vzWLDjjZSeJY8JTaTIUNEyTFS7lr0zsBEaSujrt6EQD:v8sgYLVEX4zwjINxS7xg+TScrQD

Score

7^/10

upx

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral8/memory/1372-0-0x0000000074C00000-0x0000000074C09000-memory.dmp	acprotect
behavioral8/memory/1372-1-0x0000000074C00000-0x0000000074C09000-memory.dmp	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral8/memory/1372-0-0x0000000074C00000-0x0000000074C09000-memory.dmp	upx
behavioral8/memory/1372-1-0x0000000074C00000-0x0000000074C09000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
672	1372	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 1372	4412	rundll32.exe	82
PID 4412 wrote to memory of 1372	4412	rundll32.exe	82
PID 4412 wrote to memory of 1372	4412	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1
  2⤵
  PID:1372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 612
    3⤵
    - Program crash
    PID:672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1372 -ip 1372
1⤵
PID:3728

memory/1372-0-0x0000000074C00000-0x0000000074C09000-memory.dmp

Filesize
36KB

Download
memory/1372-1-0x0000000074C00000-0x0000000074C09000-memory.dmp

Filesize
36KB

Download