fec0ec18efb17eb957f84202835cdc508c4ea5b519c99d8f0a4bdabf89006c3a

Analysis

max time kernel
10s
max time network
17s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 08:26

Target

8614c614b1cd573ee18ee8261661ca40N.dll
Size

76KB
MD5

8614c614b1cd573ee18ee8261661ca40
SHA1

90f3f5a5bc1fc5edfb69eda122af5220d98eef2e
SHA256

fec0ec18efb17eb957f84202835cdc508c4ea5b519c99d8f0a4bdabf89006c3a
SHA512

df446bcd5bd51df976fc7be58a6ada5d15598e623366987bc466e47d3c469c44c2576a3fe9de1f8d49b5a8a40c5d3f80c818c93f91012a238b69a463ec49901e
SSDEEP

1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7Zd4PI9:c8y93KQjy7G55riF1cMo03f4P2

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2520-1-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2520	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 2520	1316	rundll32.exe	30
PID 1316 wrote to memory of 2520	1316	rundll32.exe	30
PID 1316 wrote to memory of 2520	1316	rundll32.exe	30
PID 1316 wrote to memory of 2520	1316	rundll32.exe	30
PID 1316 wrote to memory of 2520	1316	rundll32.exe	30
PID 1316 wrote to memory of 2520	1316	rundll32.exe	30
PID 1316 wrote to memory of 2520	1316	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8614c614b1cd573ee18ee8261661ca40N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8614c614b1cd573ee18ee8261661ca40N.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2520

memory/2520-1-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download