daf23fe9c7bf31cd3a54c81b9b719531e8a2635d7ba30b570dc0e4259222fc70

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 15:05

Target

zapret-discord-youtube-main/cygwin1.dll
Size

998KB
MD5

c50b50303fae4afe7248307339a00d13
SHA1

1b4a3f7666172809bd0d88f793ee855bd4b92938
SHA256

712c39a069541afa69cfcbe01b422bd67b4201eee7e94cc1327d4ed8b4fa2167
SHA512

123d06a0a5f891851e372881860b9d7fb8c453dcdbbca5970b9b2bf205f08f0a724595c6892f4afbbb4f85292a886dddffbf0d36dfe18d4b6eea7a5d12451762
SSDEEP

24576:YbYJZPZf7KMuiA7Q4lsXBmStxacrFhG+wTGiPoy1u7MHltI:YAZfmM/A7Uk6xhpmGkoy1u7MH0

Score

5^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral4/memory/2788-0-0x000007FEF6150000-0x000007FEF6462000-memory.dmp	upx
behavioral4/memory/2788-2-0x000007FEF5E30000-0x000007FEF6142000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-main\cygwin1.dll,#1
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2788

memory/2788-0-0x000007FEF6150000-0x000007FEF6462000-memory.dmp

Filesize
3.1MB

Download
memory/2788-2-0x000007FEF5E30000-0x000007FEF6142000-memory.dmp

Filesize
3.1MB

Download
memory/2788-1-0x000007FEF6150000-0x000007FEF6462000-memory.dmp

Filesize
3.1MB

Download