Windows Analysis Report
24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe

Overview

General Information

Sample name: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe
Analysis ID: 1545544
MD5: 6b0996924a1ff0df14223b378c8e4fb8
SHA1: c491eb345f1cc3a701e7ace9ed3e4662830afa55
SHA256: 1e67c3ae6c79fb0768a19be602116008c06d396a81a5b206345edad34061882b
Infos:

Detection

Score: 26
Range: 0 - 100
Whitelisted: false
Confidence: 0%

Signatures

Creates an undocumented autostart registry key
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Creates a process in suspended mode (likely to inject code)
Drops PE files
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Classes Autorun Keys Modification
Sigma detected: Use Short Name Path in Command Line
Stores files to the Windows start menu directory
Uses 32bit PE files

Classification

AV Detection
barindex
Machine Learning detection for dropped file
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\is-90SFQ.tmp Joe Sandbox ML: detected
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\is-5BRVH.tmp Joe Sandbox ML: detected
Uses 32bit PE files
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Static PE information: certificate valid
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: E:\MPLAN_project\RtlDirectDiagLibv2_v4.0_5_0918_0924\RtlDirectDiagLibv2\x64\Release\RtlDirectDiagLib64.pdb source: is-LES54.tmp.2.dr
Source: Binary string: devcon.pdbGCTL source: is-CJ3T3.tmp.2.dr
Source: Binary string: C:\Gerrit_Project\RTUNICPGv2_RL6832_6431\x64\Release\RTUNicPG64.pdb source: is-AJDB4.tmp.2.dr
Source: Binary string: c:\zlib-dll\Release\isunzlib.pdb source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000002.3758147792.00000000034D3000.00000002.00000001.01000000.00000007.sdmp, 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000003.1294783523.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000002.3758278029.00000000037B6000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.2.dr
Source: Binary string: devcon.pdb source: is-CJ3T3.tmp.2.dr
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe File opened: C:\Users\user~1\ Jump to behavior
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe File opened: C:\Users\user\AppData\Local\Temp\9B10.tmp\9B11.tmp\9B12.tmp Jump to behavior
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe File opened: C:\Users\user~1\AppData\Local\ Jump to behavior
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe File opened: C:\Users\user~1\AppData\ Jump to behavior
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe File opened: C:\Users\user\AppData\Local\Temp\9B10.tmp\9B11.tmp Jump to behavior
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe File opened: C:\Users\user\AppData\Local\Temp\9B10.tmp Jump to behavior
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe String found in binary or memory: http://aia.entrust.net/ovcs2-chain.p7c01
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe String found in binary or memory: http://aia.entrust.net/ts2-chain256.p7c01
Source: is-CJ3T3.tmp.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: is-CJ3T3.tmp.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: is-LES54.tmp.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: is-CJ3T3.tmp.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: is-CJ3T3.tmp.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA.crt0
Source: is-CJ3T3.tmp.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: is-CJ3T3.tmp.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: is-AJDB4.tmp.2.dr, is-LES54.tmp.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: is-LES54.tmp.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: is-AJDB4.tmp.2.dr, is-LES54.tmp.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000003.1294783523.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000002.3758278029.00000000037B6000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.2.dr String found in binary or memory: http://crl.certum.pl/cscasha2.crl0q
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000003.1294783523.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000002.3758278029.00000000037B6000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.2.dr String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe String found in binary or memory: http://crl.entrust.net/csbr1.crl0
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe String found in binary or memory: http://crl.entrust.net/g2ca.crl0
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe String found in binary or memory: http://crl.entrust.net/ovcs2.crl0
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe String found in binary or memory: http://crl.entrust.net/ts2ca.crl0
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000003.1294783523.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000002.3758278029.00000000037B6000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.2.dr, is-AJDB4.tmp.2.dr String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: is-CJ3T3.tmp.2.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: is-LES54.tmp.2.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: is-CJ3T3.tmp.2.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: is-CJ3T3.tmp.2.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: is-CJ3T3.tmp.2.dr String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: is-AJDB4.tmp.2.dr, is-LES54.tmp.2.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: is-LES54.tmp.2.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: is-LES54.tmp.2.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: is-CJ3T3.tmp.2.dr String found in binary or memory: http://crl3.digicert.com/EVCodeSigning-g1.crl03
Source: is-CJ3T3.tmp.2.dr String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: is-CJ3T3.tmp.2.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: is-CJ3T3.tmp.2.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: is-CJ3T3.tmp.2.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: is-CJ3T3.tmp.2.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: is-CJ3T3.tmp.2.dr String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: is-AJDB4.tmp.2.dr, is-LES54.tmp.2.dr String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: is-CJ3T3.tmp.2.dr String found in binary or memory: http://crl4.digicert.com/EVCodeSigning-g1.crl0K
Source: is-CJ3T3.tmp.2.dr String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: is-CJ3T3.tmp.2.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000003.1294783523.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000002.3758278029.00000000037B6000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.2.dr, is-AJDB4.tmp.2.dr String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000003.1294783523.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000002.3758278029.00000000037B6000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.2.dr String found in binary or memory: http://cscasha2.ocsp-certum.com04
Source: is-AJDB4.tmp.2.dr, is-LES54.tmp.2.dr String found in binary or memory: http://ocsp.digicert.com0
Source: is-CJ3T3.tmp.2.dr, is-AJDB4.tmp.2.dr, is-LES54.tmp.2.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: is-CJ3T3.tmp.2.dr, is-LES54.tmp.2.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: is-CJ3T3.tmp.2.dr String found in binary or memory: http://ocsp.digicert.com0H
Source: is-CJ3T3.tmp.2.dr String found in binary or memory: http://ocsp.digicert.com0I
Source: is-CJ3T3.tmp.2.dr String found in binary or memory: http://ocsp.digicert.com0O
Source: is-LES54.tmp.2.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe String found in binary or memory: http://ocsp.entrust.net00
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe String found in binary or memory: http://ocsp.entrust.net01
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe String found in binary or memory: http://ocsp.entrust.net02
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe String found in binary or memory: http://ocsp.entrust.net03
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000003.1294783523.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000002.3758278029.00000000037B6000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.2.dr, is-AJDB4.tmp.2.dr String found in binary or memory: http://ocsp.sectigo.com0
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000003.1294783523.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000002.3758278029.00000000037B6000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.2.dr String found in binary or memory: http://repository.certum.pl/cscasha2.cer0
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000003.1294783523.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000002.3758278029.00000000037B6000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.2.dr String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000003.1294783523.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000002.3758278029.00000000037B6000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.2.dr String found in binary or memory: http://subca.ocsp-certum.com01
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000003.1294783523.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000002.3758278029.00000000037B6000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.2.dr String found in binary or memory: http://www.certum.pl/CPS0
Source: is-AJDB4.tmp.2.dr, is-LES54.tmp.2.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: is-CJ3T3.tmp.2.dr String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe String found in binary or memory: http://www.entrust.net/rpa0
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe String found in binary or memory: http://www.entrust.net/rpa03
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000003.1294783523.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000002.3758278029.00000000037B6000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.2.dr String found in binary or memory: https://jrsoftware.org/
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000003.1294783523.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000002.3758278029.00000000037B6000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.2.dr String found in binary or memory: https://jrsoftware.org0
Source: is-AJDB4.tmp.2.dr String found in binary or memory: https://sectigo.com/CPS0
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000003.1294783523.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000002.3758278029.00000000037B6000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.2.dr String found in binary or memory: https://sectigo.com/CPS0D
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000003.1294783523.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000002.3758278029.00000000037B6000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.2.dr String found in binary or memory: https://www.certum.pl/CPS0
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe, 00000000.00000002.3754032158.00000000023BD000.00000004.00001000.00020000.00000000.sdmp, 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000002.3754559130.000000000256D000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.dell.com/support/home/en-us
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe, 00000000.00000003.1290017444.0000000002570000.00000004.00001000.00020000.00000000.sdmp, 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000003.1294783523.00000000034B0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.dell.com/support/home/en-usNhttps://www.dell.com/support/home/en-usNhttps://www.dell.com
Source: is-CJ3T3.tmp.2.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe String found in binary or memory: https://www.entrust.net/rpa0
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe, 00000000.00000003.1291764771.000000007FB50000.00000004.00001000.00020000.00000000.sdmp, 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe, 00000000.00000003.1291140467.0000000002570000.00000004.00001000.00020000.00000000.sdmp, 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000000.1293109929.0000000000401000.00000020.00000001.01000000.00000004.sdmp, 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp.0.dr, is-LBEQK.tmp.2.dr String found in binary or memory: https://www.innosetup.com/
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe, 00000000.00000003.1291764771.000000007FB50000.00000004.00001000.00020000.00000000.sdmp, 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe, 00000000.00000003.1291140467.0000000002570000.00000004.00001000.00020000.00000000.sdmp, 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000000.1293109929.0000000000401000.00000020.00000001.01000000.00000004.sdmp, 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp.0.dr, is-LBEQK.tmp.2.dr String found in binary or memory: https://www.remobjects.com/ps

System Summary
barindex
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe
PE file contains executable resources (Code or Archives)
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp.0.dr Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-LBEQK.tmp.2.dr Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Sample file is different than original file name gathered from version info
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe, 00000000.00000003.1291140467.000000000265A000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFileName vs 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe, 00000000.00000000.1289649691.00000000004C6000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFileName vs 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe, 00000000.00000003.1291764771.000000007FE36000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFileName vs 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe, 00000000.00000002.3754032158.0000000002398000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamekernel32j% vs 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Binary or memory string: OriginalFileName vs 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe
Uses 32bit PE files
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: classification engine Classification label: sus26.winEXE@12/34@0/0
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp File created: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp File created: C:\Users\user\AppData\Local\Programs Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1240:120:WilError_03
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\SalomonFwUpdaterI2C64W.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\SALOMON_DOCK_MUL_INSTANCE_MUTEX
Source: C:\Users\user\Desktop\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe File created: C:\Users\user~1\AppData\Local\Temp\is-11DL1.tmp Jump to behavior
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd" /c "C:\Users\user\AppData\Local\Temp\9B10.tmp\9B11.tmp\9B12.bat "C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe""
Source: C:\Users\user\Desktop\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp File read: C:\Program Files (x86)\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization Jump to behavior
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe String found in binary or memory: /LOADINF="filename"
Source: C:\Users\user\Desktop\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe File read: C:\Users\user\Desktop\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe "C:\Users\user\Desktop\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe"
Source: C:\Users\user\Desktop\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Process created: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp "C:\Users\user~1\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp" /SL5="$103E8,2740915,793600,C:\Users\user\Desktop\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe"
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Process created: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe "C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe"
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd" /c "C:\Users\user\AppData\Local\Temp\9B10.tmp\9B11.tmp\9B12.bat "C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe""
Source: C:\Windows\System32\cmd.exe Process created: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\SalomonFwUpdaterI2C64W.exe SalomonFwUpdaterI2C64W.exe /dockinfo
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\find.exe find /i check0.log "GetSalomonDockInfo Failed, check if Dock is connected to system"
Source: C:\Users\user\Desktop\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Process created: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp "C:\Users\user~1\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp" /SL5="$103E8,2740915,793600,C:\Users\user\Desktop\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Process created: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe "C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe" Jump to behavior
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd" /c "C:\Users\user\AppData\Local\Temp\9B10.tmp\9B11.tmp\9B12.bat "C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe"" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\SalomonFwUpdaterI2C64W.exe SalomonFwUpdaterI2C64W.exe /dockinfo Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\find.exe find /i check0.log "GetSalomonDockInfo Failed, check if Dock is connected to system" Jump to behavior
Source: C:\Users\user\Desktop\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: sfc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: cmdext.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\SalomonFwUpdaterI2C64W.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\SalomonFwUpdaterI2C64W.exe Section loaded: hid.dll Jump to behavior
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\SalomonFwUpdaterI2C64W.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\SalomonFwUpdaterI2C64W.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\SalomonFwUpdaterI2C64W.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\SalomonFwUpdaterI2C64W.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\SalomonFwUpdaterI2C64W.exe Section loaded: devobj.dll Jump to behavior
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\SalomonFwUpdaterI2C64W.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\SalomonFwUpdaterI2C64W.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\find.exe Section loaded: ulib.dll Jump to behavior
Source: C:\Windows\System32\find.exe Section loaded: fsutilext.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32 Jump to behavior
Source: DellDockFW_UPGRADE_UTILITY.lnk.2.dr LNK file: ..\..\..\..\..\..\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Window found: window name: TMainForm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Automated click: Next
Source: Window Recorder Window detected: More than 3 window changes detected
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Static PE information: certificate valid
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Static file information: File size 3597832 > 1048576
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: E:\MPLAN_project\RtlDirectDiagLibv2_v4.0_5_0918_0924\RtlDirectDiagLibv2\x64\Release\RtlDirectDiagLib64.pdb source: is-LES54.tmp.2.dr
Source: Binary string: devcon.pdbGCTL source: is-CJ3T3.tmp.2.dr
Source: Binary string: C:\Gerrit_Project\RTUNICPGv2_RL6832_6431\x64\Release\RTUNicPG64.pdb source: is-AJDB4.tmp.2.dr
Source: Binary string: c:\zlib-dll\Release\isunzlib.pdb source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000002.3758147792.00000000034D3000.00000002.00000001.01000000.00000007.sdmp, 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000003.1294783523.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp, 00000002.00000002.3758278029.00000000037B6000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.2.dr
Source: Binary string: devcon.pdb source: is-CJ3T3.tmp.2.dr
PE file contains sections with non-standard names
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Static PE information: section name: .didata
Source: 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp.0.dr Static PE information: section name: .didata
Source: is-AJDB4.tmp.2.dr Static PE information: section name: _RDATA
Source: is-LES54.tmp.2.dr Static PE information: section name: _RDATA
Source: is-LES54.tmp.2.dr Static PE information: section name: .msvcjmc
Source: is-DD05B.tmp.2.dr Static PE information: section name: .gxfg
Source: is-DD05B.tmp.2.dr Static PE information: section name: .gehcont
Source: is-LBEQK.tmp.2.dr Static PE information: section name: .didata
Source: is-90SFQ.tmp.2.dr Static PE information: section name: .code
Source: is-5BRVH.tmp.2.dr Static PE information: section name: .code
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp File created: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\is-LES54.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp File created: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\RtlDirectDiagLib64.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp File created: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\is-LBEQK.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp File created: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\is-CJ3T3.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp File created: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\is-5BRVH.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp File created: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\Patch64.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp File created: C:\Users\user\AppData\Local\Temp\is-T91OE.tmp\_isetup\_isdecmp.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp File created: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\unins000.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp File created: C:\Users\user\AppData\Local\Temp\is-T91OE.tmp\_isetup\_setup64.tmp Jump to dropped file
Source: C:\Users\user\Desktop\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe File created: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp File created: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\is-DD05B.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp File created: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\SalomonFwUpdaterI2C64W.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp File created: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp File created: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\devcon64.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp File created: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\is-AJDB4.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp File created: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\is-90SFQ.tmp Jump to dropped file

Boot Survival
barindex
Creates an undocumented autostart registry key
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\OpenWithProgids DellDockFW_UPGRADE_UTILITYFile.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\OpenWithProgids DellDockFW_UPGRADE_UTILITYFile.exe Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DellDockFW_UPGRADE_UTILITY Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DellDockFW_UPGRADE_UTILITY\DellDockFW_UPGRADE_UTILITY.lnk Jump to behavior
Source: C:\Users\user\Desktop\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Window / User API: threadDelayed 9999 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Dropped PE file which has not been started: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\is-LES54.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Dropped PE file which has not been started: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\RtlDirectDiagLib64.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Dropped PE file which has not been started: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\is-LBEQK.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Dropped PE file which has not been started: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\is-CJ3T3.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Dropped PE file which has not been started: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\Patch64.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-T91OE.tmp\_isetup\_isdecmp.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Dropped PE file which has not been started: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\unins000.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-T91OE.tmp\_isetup\_setup64.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Dropped PE file which has not been started: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\devcon64.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Dropped PE file which has not been started: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\is-AJDB4.tmp Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe TID: 5604 Thread sleep time: -99990s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe File opened: C:\Users\user~1\ Jump to behavior
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe File opened: C:\Users\user\AppData\Local\Temp\9B10.tmp\9B11.tmp\9B12.tmp Jump to behavior
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe File opened: C:\Users\user~1\AppData\Local\ Jump to behavior
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe File opened: C:\Users\user~1\AppData\ Jump to behavior
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe File opened: C:\Users\user\AppData\Local\Temp\9B10.tmp\9B11.tmp Jump to behavior
Source: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe File opened: C:\Users\user\AppData\Local\Temp\9B10.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Process information queried: ProcessInformation Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\cmd.exe Process created: C:\Program Files (x86)\DellDockFW_UPGRADE_UTILITY\SalomonFwUpdaterI2C64W.exe SalomonFwUpdaterI2C64W.exe /dockinfo Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\find.exe find /i check0.log "GetSalomonDockInfo Failed, check if Dock is connected to system" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\is-11DL1.tmp\24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1545544 Sample: 24314_DellFW_UPGRADE_DOCK_U... Startdate: 30/10/2024 Architecture: WINDOWS Score: 26 36 Machine Learning detection for dropped file 2->36 38 Initial sample is a PE file and has a suspicious name 2->38 9 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe 2 2->9         started        process3 file4 26 24314_DellFW_UPGRA...CK_UTILITY_v1.2.tmp, PE32 9->26 dropped 12 24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.tmp 33 32 9->12         started        process5 file6 28 C:\Users\user\AppData\Local\...\_isdecmp.dll, PE32 12->28 dropped 30 C:\...\unins000.exe (copy), PE32 12->30 dropped 32 C:\Program Files (x86)\...\is-LES54.tmp, PE32+ 12->32 dropped 34 12 other files (11 malicious) 12->34 dropped 40 Creates an undocumented autostart registry key 12->40 16 DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe 8 12->16         started        signatures7 process8 process9 18 cmd.exe 2 16->18         started        20 conhost.exe 16->20         started        process10 22 SalomonFwUpdaterI2C64W.exe 1 18->22         started        24 find.exe 1 18->24         started       
⊘No contacted IP infos