435d51cacb6bd9222d3165df22c2306e072403f0765a6f57224ab5a732305ae0

Analysis

Target

435d51cacb6bd9222d3165df22c2306e072403f0765a6f57224ab5a732305ae0.dll
Size

199KB
MD5

2bd1db3a5357dcf620bf979eee24d073
SHA1

089424f4975b51b4f549ca7c261f553da3aa0a8d
SHA256

435d51cacb6bd9222d3165df22c2306e072403f0765a6f57224ab5a732305ae0
SHA512

f009d9feb6cc4e2eb96f410b86cd8fb78b865e25d600172a613c11bdb0f484f0bb549d8daf0656330923f8bca79f7b5aa8bc11692e4e62e1b4c78a746d084a40

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/3144-131-0x0000000000400000-0x000000000044C000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1608 3144 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1608	3144	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2432 wrote to memory of 3144	2432	rundll32.exe	rundll32.exe
PID 2432 wrote to memory of 3144	2432	rundll32.exe	rundll32.exe
PID 2432 wrote to memory of 3144	2432	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\435d51cacb6bd9222d3165df22c2306e072403f0765a6f57224ab5a732305ae0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\435d51cacb6bd9222d3165df22c2306e072403f0765a6f57224ab5a732305ae0.dll,#1
  2⤵
  PID:3144
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 568
    3⤵
    - Program crash
    PID:1608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 3144 -ip 3144
1⤵
PID:4064

memory/3144-130-0x0000000000000000-mapping.dmp

Download
memory/3144-131-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3144-132-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download