d7af9853fa6a63ee1374c1e16c535b94a6ecc1d4b1547d688d622e763a78f561

Analysis

max time kernel
200s
max time network
222s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 15:56

Target

d7af9853fa6a63ee1374c1e16c535b94a6ecc1d4b1547d688d622e763a78f561.dll
Size

1.2MB
MD5

58266a786dcd19c20c4d862574c2d340
SHA1

2ba5ddf6103506e07e05547fbb5478149bd80984
SHA256

d7af9853fa6a63ee1374c1e16c535b94a6ecc1d4b1547d688d622e763a78f561
SHA512

1792726187ddd2b06523c082d4cf1a346a3421571308b8dc6748445887fcc98a876f63688befab2f18d29f383e17bbf8506f75e38e28dc8bbcbff4f17c04bc09
SSDEEP

3072:yOr4+eC4mlbAmYCiUnti5ihgxOY4UckdI9fsbD1e9mbIFtjcVdUfIxZn:3rn5lbAmYynhNY4UvIW4xPjkde8

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/5108-133-0x0000000075420000-0x0000000075555000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

5108 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4616 5108 WerFault.exe rundll32.exe

pid	process
5108	rundll32.exe

pid	pid_target	process	target process
4616	5108	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4488 wrote to memory of 5108	4488	rundll32.exe	rundll32.exe
PID 4488 wrote to memory of 5108	4488	rundll32.exe	rundll32.exe
PID 4488 wrote to memory of 5108	4488	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d7af9853fa6a63ee1374c1e16c535b94a6ecc1d4b1547d688d622e763a78f561.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4488

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d7af9853fa6a63ee1374c1e16c535b94a6ecc1d4b1547d688d622e763a78f561.dll,#1
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 572
3⤵
- Program crash
PID:4616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5108 -ip 5108
1⤵
PID:4672

memory/5108-132-0x0000000000000000-mapping.dmp

Download
memory/5108-133-0x0000000075420000-0x0000000075555000-memory.dmp

Filesize
1.2MB

Download