ab1b01aed94f901ec6b8f3469dbe5cd3286100d86fa80bd5a9e7413ca910c932

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 04:50

Target

ab1b01aed94f901ec6b8f3469dbe5cd3286100d86fa80bd5a9e7413ca910c932.dll
Size

124KB
MD5

6f943cea06a6027796d205207f019bf4
SHA1

61bc3f94ad14b62a4ad1361b2d51dd1350676f5c
SHA256

ab1b01aed94f901ec6b8f3469dbe5cd3286100d86fa80bd5a9e7413ca910c932
SHA512

0bd29a5d6e82bd01eeb7859899e38a1733c009890337fa428f554d2c974eb2934110aede3f261d41ff8d6b23dc1f653da6c4d48f833ad541ac218a3c5d204551
SSDEEP

3072:N61Ye3TaEu2CoCcn3zO7A4D8XWzmFyf6H+MOmK:sTa12CoCckAe8gH6H+M

Score

8^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
1128	rundll32Srv.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0008000000005c51-56.dat	upx
behavioral1/files/0x0008000000005c51-59.dat	upx
behavioral1/files/0x0008000000005c51-57.dat	upx
behavioral1/memory/1128-60-0x0000000000400000-0x0000000000441000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
1752	rundll32.exe
1752	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32Srv.exe	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1932	1752	WerFault.exe	27

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 1752	1480	rundll32.exe	27
PID 1480 wrote to memory of 1752	1480	rundll32.exe	27
PID 1480 wrote to memory of 1752	1480	rundll32.exe	27
PID 1480 wrote to memory of 1752	1480	rundll32.exe	27
PID 1480 wrote to memory of 1752	1480	rundll32.exe	27
PID 1480 wrote to memory of 1752	1480	rundll32.exe	27
PID 1480 wrote to memory of 1752	1480	rundll32.exe	27
PID 1752 wrote to memory of 1128	1752	rundll32.exe	28
PID 1752 wrote to memory of 1128	1752	rundll32.exe	28
PID 1752 wrote to memory of 1128	1752	rundll32.exe	28
PID 1752 wrote to memory of 1128	1752	rundll32.exe	28
PID 1752 wrote to memory of 1932	1752	rundll32.exe	29
PID 1752 wrote to memory of 1932	1752	rundll32.exe	29
PID 1752 wrote to memory of 1932	1752	rundll32.exe	29
PID 1752 wrote to memory of 1932	1752	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab1b01aed94f901ec6b8f3469dbe5cd3286100d86fa80bd5a9e7413ca910c932.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab1b01aed94f901ec6b8f3469dbe5cd3286100d86fa80bd5a9e7413ca910c932.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\SysWOW64\rundll32Srv.exe
    C:\Windows\SysWOW64\rundll32Srv.exe
    3⤵
    - Executes dropped EXE
    PID:1128
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 228
    3⤵
    - Program crash
    PID:1932

C:\Windows\SysWOW64\rundll32Srv.exe

Filesize
62KB

MD5
6640058e9c45b96532f59c0c7775137f

SHA1
a31457cafe09d4e182ec88466fda3fbff9f84c18

SHA256
2f7b493a15bee1f1130d20c9deba402215e6c63be070de78b8435f73cf530e1b

SHA512
3d2e0f687ca99f0e8e59e2fc733b83ed50ca2b74ca82e6959585eb14dd71e94f28f92c6c3db279487530ec1f21c8e70c79b66ce5ddc0636facd4c4c85309eb0d

Download Submit
\Windows\SysWOW64\rundll32Srv.exe

Filesize
62KB

MD5
6640058e9c45b96532f59c0c7775137f

SHA1
a31457cafe09d4e182ec88466fda3fbff9f84c18

SHA256
2f7b493a15bee1f1130d20c9deba402215e6c63be070de78b8435f73cf530e1b

SHA512
3d2e0f687ca99f0e8e59e2fc733b83ed50ca2b74ca82e6959585eb14dd71e94f28f92c6c3db279487530ec1f21c8e70c79b66ce5ddc0636facd4c4c85309eb0d

Download Submit
\Windows\SysWOW64\rundll32Srv.exe

Filesize
62KB

MD5
6640058e9c45b96532f59c0c7775137f

SHA1
a31457cafe09d4e182ec88466fda3fbff9f84c18

SHA256
2f7b493a15bee1f1130d20c9deba402215e6c63be070de78b8435f73cf530e1b

SHA512
3d2e0f687ca99f0e8e59e2fc733b83ed50ca2b74ca82e6959585eb14dd71e94f28f92c6c3db279487530ec1f21c8e70c79b66ce5ddc0636facd4c4c85309eb0d

Download Submit
memory/1128-60-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1752-55-0x00000000758B1000-0x00000000758B3000-memory.dmp

Filesize
8KB

Download
memory/1752-62-0x000000006D100000-0x000000006D11F000-memory.dmp

Filesize
124KB

Download
memory/1752-63-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download