ab1b01aed94f901ec6b8f3469dbe5cd3286100d86fa80bd5a9e7413ca910c932

Analysis

max time kernel
164s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 04:50

Target

ab1b01aed94f901ec6b8f3469dbe5cd3286100d86fa80bd5a9e7413ca910c932.dll
Size

124KB
MD5

6f943cea06a6027796d205207f019bf4
SHA1

61bc3f94ad14b62a4ad1361b2d51dd1350676f5c
SHA256

ab1b01aed94f901ec6b8f3469dbe5cd3286100d86fa80bd5a9e7413ca910c932
SHA512

0bd29a5d6e82bd01eeb7859899e38a1733c009890337fa428f554d2c974eb2934110aede3f261d41ff8d6b23dc1f653da6c4d48f833ad541ac218a3c5d204551
SSDEEP

3072:N61Ye3TaEu2CoCcn3zO7A4D8XWzmFyf6H+MOmK:sTa12CoCckAe8gH6H+M

Score

8^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
4832	rundll32Srv.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/files/0x0009000000022e0d-134.dat	upx
behavioral2/files/0x0009000000022e0d-135.dat	upx
behavioral2/memory/4832-137-0x0000000000400000-0x0000000000441000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32Srv.exe	rundll32.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
696	3472	WerFault.exe	81
532	4832	WerFault.exe	83

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 3472	3608	rundll32.exe	81
PID 3608 wrote to memory of 3472	3608	rundll32.exe	81
PID 3608 wrote to memory of 3472	3608	rundll32.exe	81
PID 3472 wrote to memory of 4832	3472	rundll32.exe	83
PID 3472 wrote to memory of 4832	3472	rundll32.exe	83
PID 3472 wrote to memory of 4832	3472	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab1b01aed94f901ec6b8f3469dbe5cd3286100d86fa80bd5a9e7413ca910c932.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab1b01aed94f901ec6b8f3469dbe5cd3286100d86fa80bd5a9e7413ca910c932.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3472
- - C:\Windows\SysWOW64\rundll32Srv.exe
    C:\Windows\SysWOW64\rundll32Srv.exe
    3⤵
    - Executes dropped EXE
    PID:4832
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 272
      4⤵
      Program crash
      PID:532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 608
    3⤵
    - Program crash
    PID:696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3472 -ip 3472
1⤵
PID:4132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4832 -ip 4832
1⤵
PID:4888

C:\Windows\SysWOW64\rundll32Srv.exe

Filesize
62KB

MD5
6640058e9c45b96532f59c0c7775137f

SHA1
a31457cafe09d4e182ec88466fda3fbff9f84c18

SHA256
2f7b493a15bee1f1130d20c9deba402215e6c63be070de78b8435f73cf530e1b

SHA512
3d2e0f687ca99f0e8e59e2fc733b83ed50ca2b74ca82e6959585eb14dd71e94f28f92c6c3db279487530ec1f21c8e70c79b66ce5ddc0636facd4c4c85309eb0d

Download Submit
C:\Windows\SysWOW64\rundll32Srv.exe

Filesize
62KB

MD5
6640058e9c45b96532f59c0c7775137f

SHA1
a31457cafe09d4e182ec88466fda3fbff9f84c18

SHA256
2f7b493a15bee1f1130d20c9deba402215e6c63be070de78b8435f73cf530e1b

SHA512
3d2e0f687ca99f0e8e59e2fc733b83ed50ca2b74ca82e6959585eb14dd71e94f28f92c6c3db279487530ec1f21c8e70c79b66ce5ddc0636facd4c4c85309eb0d

Download Submit
memory/3472-136-0x000000006D100000-0x000000006D11F000-memory.dmp

Filesize
124KB

Download
memory/4832-137-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download