d7af9853fa6a63ee1374c1e16c535b94a6ecc1d4b1547d688d622e763a78f561

Analysis

max time kernel
38s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:56

Target

d7af9853fa6a63ee1374c1e16c535b94a6ecc1d4b1547d688d622e763a78f561.dll
Size

1.2MB
MD5

58266a786dcd19c20c4d862574c2d340
SHA1

2ba5ddf6103506e07e05547fbb5478149bd80984
SHA256

d7af9853fa6a63ee1374c1e16c535b94a6ecc1d4b1547d688d622e763a78f561
SHA512

1792726187ddd2b06523c082d4cf1a346a3421571308b8dc6748445887fcc98a876f63688befab2f18d29f383e17bbf8506f75e38e28dc8bbcbff4f17c04bc09
SSDEEP

3072:yOr4+eC4mlbAmYCiUnti5ihgxOY4UckdI9fsbD1e9mbIFtjcVdUfIxZn:3rn5lbAmYynhNY4UvIW4xPjkde8

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/2036-58-0x0000000074FC0000-0x00000000750F5000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

2036 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1712 2036 WerFault.exe rundll32.exe

pid	process
2036	rundll32.exe

pid	pid_target	process	target process
1712	2036	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1812 wrote to memory of 2036	1812	rundll32.exe	rundll32.exe
PID 1812 wrote to memory of 2036	1812	rundll32.exe	rundll32.exe
PID 1812 wrote to memory of 2036	1812	rundll32.exe	rundll32.exe
PID 1812 wrote to memory of 2036	1812	rundll32.exe	rundll32.exe
PID 1812 wrote to memory of 2036	1812	rundll32.exe	rundll32.exe
PID 1812 wrote to memory of 2036	1812	rundll32.exe	rundll32.exe
PID 1812 wrote to memory of 2036	1812	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1712	2036	rundll32.exe	WerFault.exe
PID 2036 wrote to memory of 1712	2036	rundll32.exe	WerFault.exe
PID 2036 wrote to memory of 1712	2036	rundll32.exe	WerFault.exe
PID 2036 wrote to memory of 1712	2036	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d7af9853fa6a63ee1374c1e16c535b94a6ecc1d4b1547d688d622e763a78f561.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 212
3⤵
- Program crash
PID:1712

memory/1712-56-0x0000000000000000-mapping.dmp

Download
memory/2036-54-0x0000000000000000-mapping.dmp

Download
memory/2036-55-0x0000000075C41000-0x0000000075C43000-memory.dmp

Filesize
8KB

Download
memory/2036-57-0x0000000075100000-0x0000000075235000-memory.dmp

Filesize
1.2MB

Download
memory/2036-58-0x0000000074FC0000-0x00000000750F5000-memory.dmp

Filesize
1.2MB

Download