be55eee17daef694697ea45a091e0ac6024a0cd94b93278e45646544708049be

Analysis

max time kernel
125s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
07-07-2024 01:08

Target

2e513e76de87333ce0a30d6bb1fb6350N.dll
Size

76KB
MD5

2e513e76de87333ce0a30d6bb1fb6350
SHA1

a41b583c1dbd0ec2b305db2452d6c11f6ab1e2ad
SHA256

be55eee17daef694697ea45a091e0ac6024a0cd94b93278e45646544708049be
SHA512

39f8f2030d3db51bd9c284839a3ab321ad38eec4a3bf804972969f524c3d5cf3128a73e4ec2b7c44a6ab3f7f302cbfe2c7f3a3c719971f983632e274cf53aba0
SSDEEP

1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZBc6:c8y93KQjy7G55riF1cMo0346

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4116-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4116-1-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2604	4116	WerFault.exe	89

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4116	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 4116	1112	rundll32.exe	89
PID 1112 wrote to memory of 4116	1112	rundll32.exe	89
PID 1112 wrote to memory of 4116	1112	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e513e76de87333ce0a30d6bb1fb6350N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e513e76de87333ce0a30d6bb1fb6350N.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 712
    3⤵
    - Program crash
    PID:2604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4116 -ip 4116
1⤵
PID:3092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4208,i,17211346206607097582,14783440229797954268,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:8
1⤵
PID:864

memory/4116-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4116-1-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download