02fc1a1bf6ee53f8c89edfe5e629cbff8f3569c552c39e981bb4d8c501892359

Analysis

max time kernel
90s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 20:09

Target

02fc1a1bf6ee53f8c89edfe5e629cbff8f3569c552c39e981bb4d8c501892359.dll
Size

93KB
MD5

0e185b704f0714c50e79218aba0f5366
SHA1

ee012a13e5b7585e1e56bc1c014e1cac9a89e71e
SHA256

02fc1a1bf6ee53f8c89edfe5e629cbff8f3569c552c39e981bb4d8c501892359
SHA512

11f41ece7ed85cf94646c8494581341de0203ea01d727357f433afdc0dcae07530743b3c25cbceef1a142dd9925779cb6c3088a8b21ba0ff5d44a993c38caddb
SSDEEP

1536:Z668xz4xPgRcPwEkQkwoUiks2GkrQvFaK8gY6KlDTWcCOXgrGR0Jg1YS7J/DA2ri:Z66HXNoUikG0QZ2vNTWTOXLSs9J/k2ri

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3088-133-0x0000000010000000-0x000000001002C000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4340	3088	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 3088	4384	rundll32.exe	81
PID 4384 wrote to memory of 3088	4384	rundll32.exe	81
PID 4384 wrote to memory of 3088	4384	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\02fc1a1bf6ee53f8c89edfe5e629cbff8f3569c552c39e981bb4d8c501892359.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\02fc1a1bf6ee53f8c89edfe5e629cbff8f3569c552c39e981bb4d8c501892359.dll,#1
  2⤵
  PID:3088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 544
    3⤵
    - Program crash
    PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3088 -ip 3088
1⤵
PID:4908

memory/3088-133-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download