5a50d092f812660e56a71bfb07dc1ee801e8b7f137a436c8853b75ab43dbb1cd

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 04:54

Target

5a50d092f812660e56a71bfb07dc1ee801e8b7f137a436c8853b75ab43dbb1cd.dll
Size

452KB
MD5

6fa51471fc073a42fd3726c8809505a2
SHA1

8fae90ae9561b3ccfea50f465e4ae8709371f271
SHA256

5a50d092f812660e56a71bfb07dc1ee801e8b7f137a436c8853b75ab43dbb1cd
SHA512

700b20f79e73e384d367e6d7b0af89da3f98a93c8834b0e0c7cff73963195c2a3e141a0c2fc95591f3baea8941fcd4b7b21643ad391a09932dcfc100516e94a7
SSDEEP

12288:MlVvN1QWguohInJDrn8zwNF7eCr1jyN27pIow:u2Sxrn80NF771jy070

Score

8^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
2128	rundll32mgr.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2128-138-0x0000000000400000-0x000000000042A000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
2128	rundll32mgr.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3112	2128	WerFault.exe	85
5088	2300	WerFault.exe	83

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 2300	4748	rundll32.exe	83
PID 4748 wrote to memory of 2300	4748	rundll32.exe	83
PID 4748 wrote to memory of 2300	4748	rundll32.exe	83
PID 2300 wrote to memory of 2128	2300	rundll32.exe	85
PID 2300 wrote to memory of 2128	2300	rundll32.exe	85
PID 2300 wrote to memory of 2128	2300	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a50d092f812660e56a71bfb07dc1ee801e8b7f137a436c8853b75ab43dbb1cd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a50d092f812660e56a71bfb07dc1ee801e8b7f137a436c8853b75ab43dbb1cd.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2128
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 524
      4⤵
      Program crash
      PID:3112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 608
    3⤵
    - Program crash
    PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2300 -ip 2300
1⤵
PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2128 -ip 2128
1⤵
PID:3140

C:\Users\Admin\AppData\Local\Temp\~TMA3E6.tmp

Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
106KB

MD5
bcf377e2eda50d577b1215da4dd4f2fe

SHA1
198ac4da4b587c5c2769c6727bd8574fc87ea71e

SHA256
58978ff9757977b7f4b67506f93c650f6cda9c270dcc2609421aeeaae72f96e1

SHA512
7bad3dbaf60d64dabf25a5edc8b230e6cd4533079285aa75b12a52eaf92cf9c8d9ac5ed318e9e498cd2409be4deff2b8d898844c8ee5fcef610322b9adf47a83

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
106KB

MD5
bcf377e2eda50d577b1215da4dd4f2fe

SHA1
198ac4da4b587c5c2769c6727bd8574fc87ea71e

SHA256
58978ff9757977b7f4b67506f93c650f6cda9c270dcc2609421aeeaae72f96e1

SHA512
7bad3dbaf60d64dabf25a5edc8b230e6cd4533079285aa75b12a52eaf92cf9c8d9ac5ed318e9e498cd2409be4deff2b8d898844c8ee5fcef610322b9adf47a83

Download Submit
memory/2128-138-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2128-139-0x00000000005B0000-0x00000000005DA000-memory.dmp

Filesize
168KB

Download
memory/2128-140-0x00000000775B0000-0x0000000077753000-memory.dmp

Filesize
1.6MB

Download
memory/2300-137-0x000000007C360000-0x000000007C3D2000-memory.dmp

Filesize
456KB

Download