6937e91619b99c88e7a4f0a84ccc190d074243948194ceae27bf701f44c1ed64

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 21:57

Target

6937e91619b99c88e7a4f0a84ccc190d074243948194ceae27bf701f44c1ed64.dll
Size

16KB
MD5

800c0b9c9f31682c460f8789fe493b61
SHA1

19c2b6339a35f6a0e72d245c18a78da0f7c2dd82
SHA256

6937e91619b99c88e7a4f0a84ccc190d074243948194ceae27bf701f44c1ed64
SHA512

c57168cf75f4314f57e8fe6f5e30525f74a9a7e8e152ff752a03c19db125a02c486309e121f8ba2f510760fb378103ec940204260b21461169918803de71f8cd
SSDEEP

384:S9a7L+KQ6B1WiXZopmPgzXmRYElh1LB9RTlnXLRbzlo:SYW6rGpUIJmLNlXFbG

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/964-56-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1948	964	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 964	1184	rundll32.exe	26
PID 1184 wrote to memory of 964	1184	rundll32.exe	26
PID 1184 wrote to memory of 964	1184	rundll32.exe	26
PID 1184 wrote to memory of 964	1184	rundll32.exe	26
PID 1184 wrote to memory of 964	1184	rundll32.exe	26
PID 1184 wrote to memory of 964	1184	rundll32.exe	26
PID 1184 wrote to memory of 964	1184	rundll32.exe	26
PID 964 wrote to memory of 1948	964	rundll32.exe	27
PID 964 wrote to memory of 1948	964	rundll32.exe	27
PID 964 wrote to memory of 1948	964	rundll32.exe	27
PID 964 wrote to memory of 1948	964	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6937e91619b99c88e7a4f0a84ccc190d074243948194ceae27bf701f44c1ed64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6937e91619b99c88e7a4f0a84ccc190d074243948194ceae27bf701f44c1ed64.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 228
    3⤵
    - Program crash
    PID:1948

memory/964-55-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

Filesize
8KB

Download
memory/964-56-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download