9a6dfa902242eb9b67ea40a3bbe491bd00e7eca17030c62ebe7ef998d5848c2b

Analysis

max time kernel
166s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 17:16

Target

9a6dfa902242eb9b67ea40a3bbe491bd00e7eca17030c62ebe7ef998d5848c2b.dll
Size

300KB
MD5

0b4d2886d323bdd77fd71a8388c7611e
SHA1

4aedb19eeb153ce6933fb8cdf20d032aa282b628
SHA256

9a6dfa902242eb9b67ea40a3bbe491bd00e7eca17030c62ebe7ef998d5848c2b
SHA512

e869749ec8fb7412695e5c9b90f90c486109b1eedc3099ff5f7899be30a5fe1bdb3936f0e5b2a2ad4b1c659b348be51df3b0afb6efa308effdb18c37faf6429b
SSDEEP

6144:wfvvKKzAYf0L+6i0t+myTC7dQe0gKss4KJJzujIRryZCI4W7RUR:kvrzAYYj+myTC7UfpfzOIRGYW7RU

Score

8^/10

upx

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

4 4184 rundll32.exe

flow	pid	process
4	4184	rundll32.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4184-133-0x0000000001FA0000-0x0000000002086000-memory.dmp	upx

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2696 4184 WerFault.exe rundll32.exe
4284 4184 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2696	4184	WerFault.exe	rundll32.exe
4284	4184	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 724 wrote to memory of 4184	724	rundll32.exe	rundll32.exe
PID 724 wrote to memory of 4184	724	rundll32.exe	rundll32.exe
PID 724 wrote to memory of 4184	724	rundll32.exe	rundll32.exe
PID 4184 wrote to memory of 2696	4184	rundll32.exe	WerFault.exe
PID 4184 wrote to memory of 2696	4184	rundll32.exe	WerFault.exe
PID 4184 wrote to memory of 2696	4184	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a6dfa902242eb9b67ea40a3bbe491bd00e7eca17030c62ebe7ef998d5848c2b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 836
3⤵
- Program crash
PID:2696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 836
3⤵
- Program crash
PID:4284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4184 -ip 4184
1⤵
PID:5100

memory/2696-134-0x0000000000000000-mapping.dmp

Download
memory/4184-132-0x0000000000000000-mapping.dmp

Download
memory/4184-133-0x0000000001FA0000-0x0000000002086000-memory.dmp

Filesize
920KB

Download