8c508472a841d871c6e7a8ef8ddc30d1bb6580b3fce0278a3d0c0a6ab6bf3c6b

Analysis

max time kernel
163s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 03:29

Target

8c508472a841d871c6e7a8ef8ddc30d1bb6580b3fce0278a3d0c0a6ab6bf3c6b.dll
Size

16KB
MD5

62510b07cb82d5cfcd44ae95a688f232
SHA1

39b9884932edab792f6a31bfc41394ec97c14068
SHA256

8c508472a841d871c6e7a8ef8ddc30d1bb6580b3fce0278a3d0c0a6ab6bf3c6b
SHA512

735a2ae5aff5d10e1299c47e084e9d467cdcb87e1e9729a41881d2a27b0fb545df47f1209c19fc7c1f104cff387bc7853fb4f1c80298f2dbf9e92a9c9d8b3052
SSDEEP

384:S9a7L+KQ6B1WiXZopmPgzXmRYElh1LB9RTlnXLRbzly:SYW6rGpUIJmLNlXFbo

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/980-133-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1080	980	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 980	5016	rundll32.exe	81
PID 5016 wrote to memory of 980	5016	rundll32.exe	81
PID 5016 wrote to memory of 980	5016	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c508472a841d871c6e7a8ef8ddc30d1bb6580b3fce0278a3d0c0a6ab6bf3c6b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c508472a841d871c6e7a8ef8ddc30d1bb6580b3fce0278a3d0c0a6ab6bf3c6b.dll,#1
  2⤵
  PID:980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 600
    3⤵
    - Program crash
    PID:1080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 980 -ip 980
1⤵
PID:3160

memory/980-133-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download