c6c170eaed861cdc1e92f45a99e7d1986d6c1318f3c41e0bf8b00a2c12f065a5

Analysis

max time kernel
86s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2022, 22:53

Target

c6c170eaed861cdc1e92f45a99e7d1986d6c1318f3c41e0bf8b00a2c12f065a5.dll
Size

30KB
MD5

b3cd2b2f1ea2967307b8f963f9494e9a
SHA1

934c8cbe6b022d0bd036b8c9f254f2c954f314bd
SHA256

c6c170eaed861cdc1e92f45a99e7d1986d6c1318f3c41e0bf8b00a2c12f065a5
SHA512

bfe0959b8cf20095263b552b182a5871d73ed8232e37884d1daca84fdda6addf6f7bd2dacfaed87aeaf5ca16bad4b00c3bfba163e3300281bcef107c5da1161d
SSDEEP

768:GzIRK55ozOYcxVx6RO6+uU3EczET2NX2vBf4pkuHz:GzIg5o1uVx0OjUlT2NXiUkuHz

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4860-134-0x0000000000800000-0x0000000000820000-memory.dmp	upx
behavioral2/memory/4860-136-0x0000000000800000-0x0000000000820000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1428	4860	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 4860	4656	rundll32.exe	81
PID 4656 wrote to memory of 4860	4656	rundll32.exe	81
PID 4656 wrote to memory of 4860	4656	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6c170eaed861cdc1e92f45a99e7d1986d6c1318f3c41e0bf8b00a2c12f065a5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6c170eaed861cdc1e92f45a99e7d1986d6c1318f3c41e0bf8b00a2c12f065a5.dll,#1
  2⤵
  PID:4860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 600
    3⤵
    - Program crash
    PID:1428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4860 -ip 4860
1⤵
PID:1664

memory/4860-133-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/4860-134-0x0000000000800000-0x0000000000820000-memory.dmp

Filesize
128KB

Download
memory/4860-135-0x00000000008A0000-0x00000000008C0000-memory.dmp

Filesize
128KB

Download
memory/4860-136-0x0000000000800000-0x0000000000820000-memory.dmp

Filesize
128KB

Download