69f9f26f0c1995d706b0a5f29dc480b56660e91f9bb049045f54187ef01617fd

Analysis

max time kernel
137s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 10:52

Target

69f9f26f0c1995d706b0a5f29dc480b56660e91f9bb049045f54187ef01617fd.dll
Size

141KB
MD5

3b1c5ffc45a703a7081d17ab57846c80
SHA1

4417b320106a138cfe8660c7d31a901e326fb535
SHA256

69f9f26f0c1995d706b0a5f29dc480b56660e91f9bb049045f54187ef01617fd
SHA512

49d0f8d4813525609c8060a2c7e1a470f026cc944414990049d925421188059306cbfc07233183919fa42e29141b2ceea4f9bbfe017bf4422248e27028f67e28
SSDEEP

1536:VOzMIXh3CrmyOrRFoRKD5UP0YSSz0K+SKZ9kdF0P6fFSa+rdWigqksTGnDgSG+3:VEFh3PyOrRqRlP0K+XZ9gRUksCnsE3

Score

8^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
2720	rundll32mgr.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/files/0x0006000000022dfc-134.dat	upx
behavioral2/files/0x0006000000022dfc-135.dat	upx
behavioral2/memory/2720-136-0x0000000000400000-0x0000000000462000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1640	2720	WerFault.exe	85

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 1436	8	rundll32.exe	83
PID 8 wrote to memory of 1436	8	rundll32.exe	83
PID 8 wrote to memory of 1436	8	rundll32.exe	83
PID 1436 wrote to memory of 2720	1436	rundll32.exe	85
PID 1436 wrote to memory of 2720	1436	rundll32.exe	85
PID 1436 wrote to memory of 2720	1436	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\69f9f26f0c1995d706b0a5f29dc480b56660e91f9bb049045f54187ef01617fd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:8
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\69f9f26f0c1995d706b0a5f29dc480b56660e91f9bb049045f54187ef01617fd.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    PID:2720
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 260
      4⤵
      Program crash
      PID:1640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2720 -ip 2720
1⤵
PID:4440

C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
132KB

MD5
cbd38d234814dc2b368a90a57e0b8ec1

SHA1
648ea0a1598ab0c1d91e1f45157b5ca6a6bc1dc4

SHA256
f761a2068bfd80d7bb1e9ccd6cca47be2952fa641b85494cbabbd336d4f2d786

SHA512
7866a0c6b7bcc272428062e744873a4457a5519a5731e377ecc661e76051bb5078b8c04c804816c847dc4964033893bea7f6815b9febb26f8d00a20157a0bab2

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
132KB

MD5
cbd38d234814dc2b368a90a57e0b8ec1

SHA1
648ea0a1598ab0c1d91e1f45157b5ca6a6bc1dc4

SHA256
f761a2068bfd80d7bb1e9ccd6cca47be2952fa641b85494cbabbd336d4f2d786

SHA512
7866a0c6b7bcc272428062e744873a4457a5519a5731e377ecc661e76051bb5078b8c04c804816c847dc4964033893bea7f6815b9febb26f8d00a20157a0bab2

Download Submit
memory/2720-136-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download