b35aa3b9a770b8709f70c06a06967e6cb380693e6532f0c147bd032476f1736f

Analysis

max time kernel
144s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 12:06

Target

b35aa3b9a770b8709f70c06a06967e6cb380693e6532f0c147bd032476f1736f.dll
Size

296KB
MD5

107c9c010bdee99d63773915c0b7b740
SHA1

e0457749001251a67733d1b3c66a1a32d1d5cb06
SHA256

b35aa3b9a770b8709f70c06a06967e6cb380693e6532f0c147bd032476f1736f
SHA512

419ee6d22195d5c64d676cc322bbdf32b1383dd884466708d4469c6a4e1bb5e71ec6a3f892969ed64752516f37f55efc664f93f55741f8bb997448aa17e446dc
SSDEEP

3072:SFz4lLrcUSTTBLwrFXf9AN/mnfJo9WUg9JzLQC/sJeobeX19Ebaw4l9Sdyqij2n/:k4EPBqFXVAwf1Ug9JICh5w6S9i6nqQZ

Score

8^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
4652	rundll32mgr.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/files/0x0009000000022e0b-134.dat	upx
behavioral2/files/0x0009000000022e0b-135.dat	upx
behavioral2/memory/4652-137-0x0000000000400000-0x0000000000454000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4800	4748	WerFault.exe	81
5088	4652	WerFault.exe	82

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 4748	4684	rundll32.exe	81
PID 4684 wrote to memory of 4748	4684	rundll32.exe	81
PID 4684 wrote to memory of 4748	4684	rundll32.exe	81
PID 4748 wrote to memory of 4652	4748	rundll32.exe	82
PID 4748 wrote to memory of 4652	4748	rundll32.exe	82
PID 4748 wrote to memory of 4652	4748	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b35aa3b9a770b8709f70c06a06967e6cb380693e6532f0c147bd032476f1736f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b35aa3b9a770b8709f70c06a06967e6cb380693e6532f0c147bd032476f1736f.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    PID:4652
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 268
      4⤵
      Program crash
      PID:5088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 632
    3⤵
    - Program crash
    PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4652 -ip 4652
1⤵
PID:876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4748 -ip 4748
1⤵
PID:5056

C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
99KB

MD5
f57eee1185dee33198b752dd1f66ad55

SHA1
b60f88d65f8805bf2ca095ecd1727b15eed4ff12

SHA256
6bb93bea58d84b9c6a562a6b888ec84ba0ecb7575b6c8f3264a9e9fb44ee37f7

SHA512
cd97a2207d7ad6178cc7c9fb13fda7015bc30a924aa43b6e8ba07961ef878a841e6d025047a35e3b60ef23a3ab9b59b16d1abe09f39dc0cd6e5515d46630ad40

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
99KB

MD5
f57eee1185dee33198b752dd1f66ad55

SHA1
b60f88d65f8805bf2ca095ecd1727b15eed4ff12

SHA256
6bb93bea58d84b9c6a562a6b888ec84ba0ecb7575b6c8f3264a9e9fb44ee37f7

SHA512
cd97a2207d7ad6178cc7c9fb13fda7015bc30a924aa43b6e8ba07961ef878a841e6d025047a35e3b60ef23a3ab9b59b16d1abe09f39dc0cd6e5515d46630ad40

Download Submit
memory/4652-137-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4748-136-0x0000000010000000-0x000000001004C000-memory.dmp

Filesize
304KB

Download