fec0ec18efb17eb957f84202835cdc508c4ea5b519c99d8f0a4bdabf89006c3a

Analysis

max time kernel
115s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 08:26

Target
8614c614b1cd573ee18ee8261661ca40N.dll
Size 76KB
Sample240722-kbw6jsxelf
SHA256 fec0ec18efb17eb957f84202835cdc508c4ea5b519c99d8f0a4bdabf89006c3a
MD5 8614c614b1cd573ee18ee8261661ca40
SHA1 90f3f5a5bc1fc5edfb69eda122af5220d98eef2e
SHA512 df446bcd5bd51df976fc7be58a6ada5d15598e623366987bc466e47d3c469c44c2576a3fe9de1f8d49b5a8a40c5d3f80c818c93f91012a238b69a463ec49901e
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7Zd4PI9:c8y93KQjy7G55riF1cMo03f4P2
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/464-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/464-2-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4148	464	WerFault.exe	84

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	464	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 464	2860	rundll32.exe	84
PID 2860 wrote to memory of 464	2860	rundll32.exe	84
PID 2860 wrote to memory of 464	2860	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8614c614b1cd573ee18ee8261661ca40N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8614c614b1cd573ee18ee8261661ca40N.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 464 -s 704
    3⤵
    - Program crash
    PID:4148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 464 -ip 464
1⤵
PID:2436

memory/464-0-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/464-2-0x0000000010000000-0x0000000010030000-memory.dmp

Download