b7b8ad16c600ef505f2cde05e91fc027e179e2e1af3e9d139203fdb2d19e2ca3

Analysis

max time kernel
99s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 19:56

Target

b7b8ad16c600ef505f2cde05e91fc027e179e2e1af3e9d139203fdb2d19e2ca3.dll
Size

500KB
MD5

498b18f9114e04e726686b9fa2f17105
SHA1

8376351392ff09ba25eb7787004e08293d9701b9
SHA256

b7b8ad16c600ef505f2cde05e91fc027e179e2e1af3e9d139203fdb2d19e2ca3
SHA512

f66fcb329772ec7c40bf2e3b2be90bb26c6e05ca174781fab40243aaa45d52ec27d2bf71f0cc05cc541f0e7676f8f06bc294970399d006ef29f6f887aad8da46
SSDEEP

12288:NV7LMzw56Wx1Dk/qon6xyYhgPFaUVltv3H/QGe:91oC3yWgPFFfy

Score

8^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
404	rundll32mgr.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/files/0x0004000000022dbd-134.dat	upx
behavioral2/files/0x0004000000022dbd-135.dat	upx
behavioral2/memory/404-136-0x0000000000400000-0x000000000045B000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1300	404	WerFault.exe	83

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 4964	4228	rundll32.exe	82
PID 4228 wrote to memory of 4964	4228	rundll32.exe	82
PID 4228 wrote to memory of 4964	4228	rundll32.exe	82
PID 4964 wrote to memory of 404	4964	rundll32.exe	83
PID 4964 wrote to memory of 404	4964	rundll32.exe	83
PID 4964 wrote to memory of 404	4964	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7b8ad16c600ef505f2cde05e91fc027e179e2e1af3e9d139203fdb2d19e2ca3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7b8ad16c600ef505f2cde05e91fc027e179e2e1af3e9d139203fdb2d19e2ca3.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    PID:404
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 272
      4⤵
      Program crash
      PID:1300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 404 -ip 404
1⤵
PID:3156

C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
105KB

MD5
dfb5daabb95dcfad1a5faf9ab1437076

SHA1
4a199569a9b52911bee7fb19ab80570cc5ff9ed1

SHA256
54282ec29d4993ed6e9972122cfbb70bba4898a21d527bd9e72a166d7ec2fdc0

SHA512
5d31c34403ab5f8db4a6d84f2b5579d4ea18673914b626d78e458a648ac20ddd8e342818e807331036d7bb064f596a02b9737acac42fbead29260343a30717e8

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
105KB

MD5
dfb5daabb95dcfad1a5faf9ab1437076

SHA1
4a199569a9b52911bee7fb19ab80570cc5ff9ed1

SHA256
54282ec29d4993ed6e9972122cfbb70bba4898a21d527bd9e72a166d7ec2fdc0

SHA512
5d31c34403ab5f8db4a6d84f2b5579d4ea18673914b626d78e458a648ac20ddd8e342818e807331036d7bb064f596a02b9737acac42fbead29260343a30717e8

Download Submit
memory/404-136-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download