3d4602af73ce268c22d3aa3f1618a302efc8eb72150d1613368237ac6f41be5e

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 15:57

Target

3d4602af73ce268c22d3aa3f1618a302efc8eb72150d1613368237ac6f41be5e.dll
Size

115KB
MD5

48d46c950cad769d1a6ab34a9a2df703
SHA1

60ef16426af642d7c12693e703a8d4cc5bbe9988
SHA256

3d4602af73ce268c22d3aa3f1618a302efc8eb72150d1613368237ac6f41be5e
SHA512

c8d40151f31e377db139d41df0026395d7be647c14b4b064b3ff69f9bdf452d3b23caac8c4692ff147d5b7ab8352f9f9608ed432cff4a21e2706205be5b77d10
SSDEEP

3072:tGe98hK0U+rB1QlJksW/sBncpppiXOLNweDoTWlVz:tG0hk/y+NDFlVz

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4116-133-0x0000000000A00000-0x0000000000A5C000-memory.dmp	upx
behavioral2/memory/4116-134-0x0000000000A00000-0x0000000000A5C000-memory.dmp	upx
behavioral2/memory/4116-135-0x0000000000A00000-0x0000000000A5C000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2908	4116	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 4116	2560	rundll32.exe	82
PID 2560 wrote to memory of 4116	2560	rundll32.exe	82
PID 2560 wrote to memory of 4116	2560	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d4602af73ce268c22d3aa3f1618a302efc8eb72150d1613368237ac6f41be5e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d4602af73ce268c22d3aa3f1618a302efc8eb72150d1613368237ac6f41be5e.dll,#1
  2⤵
  PID:4116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 1016
    3⤵
    - Program crash
    PID:2908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4116 -ip 4116
1⤵
PID:1664

memory/4116-133-0x0000000000A00000-0x0000000000A5C000-memory.dmp

Filesize
368KB

Download
memory/4116-134-0x0000000000A00000-0x0000000000A5C000-memory.dmp

Filesize
368KB

Download
memory/4116-135-0x0000000000A00000-0x0000000000A5C000-memory.dmp

Filesize
368KB

Download