6937e91619b99c88e7a4f0a84ccc190d074243948194ceae27bf701f44c1ed64

Analysis

max time kernel
145s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 21:57

Target

6937e91619b99c88e7a4f0a84ccc190d074243948194ceae27bf701f44c1ed64.dll
Size

16KB
MD5

800c0b9c9f31682c460f8789fe493b61
SHA1

19c2b6339a35f6a0e72d245c18a78da0f7c2dd82
SHA256

6937e91619b99c88e7a4f0a84ccc190d074243948194ceae27bf701f44c1ed64
SHA512

c57168cf75f4314f57e8fe6f5e30525f74a9a7e8e152ff752a03c19db125a02c486309e121f8ba2f510760fb378103ec940204260b21461169918803de71f8cd
SSDEEP

384:S9a7L+KQ6B1WiXZopmPgzXmRYElh1LB9RTlnXLRbzlo:SYW6rGpUIJmLNlXFbG

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3188-133-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4396	3188	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 3188	3236	rundll32.exe	81
PID 3236 wrote to memory of 3188	3236	rundll32.exe	81
PID 3236 wrote to memory of 3188	3236	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6937e91619b99c88e7a4f0a84ccc190d074243948194ceae27bf701f44c1ed64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6937e91619b99c88e7a4f0a84ccc190d074243948194ceae27bf701f44c1ed64.dll,#1
  2⤵
  PID:3188
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 600
    3⤵
    - Program crash
    PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3188 -ip 3188
1⤵
PID:4508

memory/3188-133-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download