809d1ab76c4e88b1124324b6d474bc26b9c2997ef68f2b414d03063055a7de82

Analysis

max time kernel
75s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 17:22

Target

809d1ab76c4e88b1124324b6d474bc26b9c2997ef68f2b414d03063055a7de82.dll
Size

403KB
MD5

80cb6c7db556258fe8eb321c78e694cb
SHA1

fcc284ea4bb433be29c847f86722ee564b6f733c
SHA256

809d1ab76c4e88b1124324b6d474bc26b9c2997ef68f2b414d03063055a7de82
SHA512

9865f83b9414111623807674a5a73d5ffba07f88b7fc508c6516c2d29df00b87e4c5c28e1c2dc6da36c5ed02b243b666263493128e49e21e23721d61fd909909
SSDEEP

12288:ktKItUUsDaRPCalxEiNLJjN4Djpnl+qsJ/gdh+:2K4rIalGeLZN4Pyp/g+

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4840-133-0x0000000000400000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4840-134-0x0000000000400000-0x0000000000510000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
920	4840	WerFault.exe	83

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4840	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 4840	2364	rundll32.exe	83
PID 2364 wrote to memory of 4840	2364	rundll32.exe	83
PID 2364 wrote to memory of 4840	2364	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\809d1ab76c4e88b1124324b6d474bc26b9c2997ef68f2b414d03063055a7de82.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\809d1ab76c4e88b1124324b6d474bc26b9c2997ef68f2b414d03063055a7de82.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 616
    3⤵
    - Program crash
    PID:920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4840 -ip 4840
1⤵
PID:4304

memory/4840-133-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/4840-134-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download