0029967ff963ffe6e7e6a3126b186d4613b85945c9501315037088fb9e037576

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 17:28

Target

00db82ff732b2886e7c827b343b06dc0N.dll
Size

76KB
MD5

00db82ff732b2886e7c827b343b06dc0
SHA1

006df3d76e4a99c7cf57b5d815ed5b242717adc3
SHA256

0029967ff963ffe6e7e6a3126b186d4613b85945c9501315037088fb9e037576
SHA512

7172e45aed2851a2bdb5a090a1b332fb881c4a68775c51c75ca031df9acdb81212bde83e8a0bcbaa4d5180d49b0fd69ed319f9426ef2766056d45a7a2460d730
SSDEEP

1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZGpSRGZnx:c8y93KQjy7G55riF1cMo03Cxx

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2788-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2788-2-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2788-1-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2696	2788	WerFault.exe	30

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2788	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2788	2756	rundll32.exe	30
PID 2756 wrote to memory of 2788	2756	rundll32.exe	30
PID 2756 wrote to memory of 2788	2756	rundll32.exe	30
PID 2756 wrote to memory of 2788	2756	rundll32.exe	30
PID 2756 wrote to memory of 2788	2756	rundll32.exe	30
PID 2756 wrote to memory of 2788	2756	rundll32.exe	30
PID 2756 wrote to memory of 2788	2756	rundll32.exe	30
PID 2788 wrote to memory of 2696	2788	rundll32.exe	31
PID 2788 wrote to memory of 2696	2788	rundll32.exe	31
PID 2788 wrote to memory of 2696	2788	rundll32.exe	31
PID 2788 wrote to memory of 2696	2788	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00db82ff732b2886e7c827b343b06dc0N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\00db82ff732b2886e7c827b343b06dc0N.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 328
    3⤵
    - Program crash
    PID:2696

memory/2788-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2788-2-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2788-1-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download