22b2e0ff0b2b91efc6be953be947cd3bf2429fd9da980cfaac204e181db442bd

Analysis

max time kernel
110s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 07:58

Target

6a729857964486e9a75f17641ac328c0N.dll
Size

76KB
MD5

6a729857964486e9a75f17641ac328c0
SHA1

508c2fd275c1e3eb6c3c49e4ba5d5fad1b6c4e45
SHA256

22b2e0ff0b2b91efc6be953be947cd3bf2429fd9da980cfaac204e181db442bd
SHA512

8e4f356ac12f2d93ffff327dcb6883fa802e11c6e1a674cf77e1a6ebeaa373fcf13d0fed8463bb59bc780c202bbaed94e87252c83fea428399f5cb645bd0c2a7
SSDEEP

1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7Zfujp3Yu0:c8y93KQjy7G55riF1cMo039g1Yu0

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2368-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2368-1-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2368	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2368	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2368	1724	rundll32.exe	30
PID 1724 wrote to memory of 2368	1724	rundll32.exe	30
PID 1724 wrote to memory of 2368	1724	rundll32.exe	30
PID 1724 wrote to memory of 2368	1724	rundll32.exe	30
PID 1724 wrote to memory of 2368	1724	rundll32.exe	30
PID 1724 wrote to memory of 2368	1724	rundll32.exe	30
PID 1724 wrote to memory of 2368	1724	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a729857964486e9a75f17641ac328c0N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a729857964486e9a75f17641ac328c0N.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2368

memory/2368-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2368-1-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download