cbe2bc958374e1cb99cb594fc507ad59da89191920fc9623e39436d6992a3244

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 06:51

Target

cbe2bc958374e1cb99cb594fc507ad59da89191920fc9623e39436d6992a3244.dll
Size

170KB
MD5

d08fbab858936a0d559a2184e3419daa
SHA1

29ae3c8055a3ba2a4c0f24b03b9674ffd8d328cc
SHA256

cbe2bc958374e1cb99cb594fc507ad59da89191920fc9623e39436d6992a3244
SHA512

f4bd3c8afb23528f6ca7c198402592c4df7b4e872adf79d03f4f7b7f0736928f4d0fdbb5056bd6ae172c0a3f85033cbf7dcca728d2e9b6973cb8adbf4d73986c
SSDEEP

3072:EKITNYhJpYRuXuSjpEtrgmN2VmJYp1CtIh/6EJV09z099XTLXOtZc7Yaw:EKIGWO7EWJ8JOYCvJVgY9dvJ7N

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1356-57-0x0000000010000000-0x0000000010085000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1172 1356 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1172	1356	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1212 wrote to memory of 1356	1212	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 1356	1212	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 1356	1212	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 1356	1212	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 1356	1212	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 1356	1212	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 1356	1212	rundll32.exe	rundll32.exe
PID 1356 wrote to memory of 1172	1356	rundll32.exe	WerFault.exe
PID 1356 wrote to memory of 1172	1356	rundll32.exe	WerFault.exe
PID 1356 wrote to memory of 1172	1356	rundll32.exe	WerFault.exe
PID 1356 wrote to memory of 1172	1356	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbe2bc958374e1cb99cb594fc507ad59da89191920fc9623e39436d6992a3244.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1212

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbe2bc958374e1cb99cb594fc507ad59da89191920fc9623e39436d6992a3244.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 228
3⤵
- Program crash
PID:1172

memory/1172-56-0x0000000000000000-mapping.dmp

Download
memory/1356-54-0x0000000000000000-mapping.dmp

Download
memory/1356-55-0x0000000076711000-0x0000000076713000-memory.dmp

Filesize
8KB

Download
memory/1356-57-0x0000000010000000-0x0000000010085000-memory.dmp

Filesize
532KB

Download