9877c36bc448618bb061eb08ade6086bf6908973bf3497563382ce7c7326b376

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04-10-2022 03:29

Target

9877c36bc448618bb061eb08ade6086bf6908973bf3497563382ce7c7326b376.dll
Size

16KB
MD5

621b9c1d65db2fd6e5255bab2194fabf
SHA1

a45a071f0d7a3108d4210a763402d4a2f7db5624
SHA256

9877c36bc448618bb061eb08ade6086bf6908973bf3497563382ce7c7326b376
SHA512

a4cdc2a2ae9edf4c36a4f4841361971abac7ecb56ee4ea21eb2f07d88181d43df50ae9c4ed41ed66df336f2284b422d0e41a4c3d50829aa198a8737031738d21
SSDEEP

384:S9a7L+KQ6B1WiXZopmPgzXmRYElh1LB9RTlnXLRbzle:SYW6rGpUIJmLNlXFbs

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1708-57-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1288	1708	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 1708	620	rundll32.exe	27
PID 620 wrote to memory of 1708	620	rundll32.exe	27
PID 620 wrote to memory of 1708	620	rundll32.exe	27
PID 620 wrote to memory of 1708	620	rundll32.exe	27
PID 620 wrote to memory of 1708	620	rundll32.exe	27
PID 620 wrote to memory of 1708	620	rundll32.exe	27
PID 620 wrote to memory of 1708	620	rundll32.exe	27
PID 1708 wrote to memory of 1288	1708	rundll32.exe	28
PID 1708 wrote to memory of 1288	1708	rundll32.exe	28
PID 1708 wrote to memory of 1288	1708	rundll32.exe	28
PID 1708 wrote to memory of 1288	1708	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9877c36bc448618bb061eb08ade6086bf6908973bf3497563382ce7c7326b376.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9877c36bc448618bb061eb08ade6086bf6908973bf3497563382ce7c7326b376.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 228
    3⤵
    - Program crash
    PID:1288

memory/1288-56-0x0000000000000000-mapping.dmp

Download
memory/1708-54-0x0000000000000000-mapping.dmp

Download
memory/1708-55-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download
memory/1708-57-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download