75bf32677b25592d07f6351a49384be81cb28f39530dee6cc8d862bded1de267

Analysis

max time kernel
170s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 19:39

Target

75bf32677b25592d07f6351a49384be81cb28f39530dee6cc8d862bded1de267.dll
Size

124KB
MD5

4694c21370c6dc10d5cb918d6bdccea8
SHA1

a830b17d1a87604241d43f0188d4b85d0b2ef9d6
SHA256

75bf32677b25592d07f6351a49384be81cb28f39530dee6cc8d862bded1de267
SHA512

950af102dcd08b7f8de88fc4e1cdd78149bac86ca95e1b262a539a9c399688c65427b012a139ac7c4669f8de9271033bc26b26904193410322c4b7fd16d2b3b6
SSDEEP

3072:hwwpKkoo9c+nvYc2Yn25KozC+VWH39K4+m4HgIbrRj+8SOlX:Owp6o9fngE2oozZVWHt8t

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4992-133-0x0000000000810000-0x000000000086F000-memory.dmp	upx
behavioral2/memory/4992-134-0x0000000000810000-0x000000000086F000-memory.dmp	upx
behavioral2/memory/4992-135-0x0000000000810000-0x000000000086F000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3868	4992	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 4992	4924	rundll32.exe	83
PID 4924 wrote to memory of 4992	4924	rundll32.exe	83
PID 4924 wrote to memory of 4992	4924	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\75bf32677b25592d07f6351a49384be81cb28f39530dee6cc8d862bded1de267.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\75bf32677b25592d07f6351a49384be81cb28f39530dee6cc8d862bded1de267.dll,#1
  2⤵
  PID:4992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1012
    3⤵
    - Program crash
    PID:3868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4992 -ip 4992
1⤵
PID:2588

memory/4992-133-0x0000000000810000-0x000000000086F000-memory.dmp

Filesize
380KB

Download
memory/4992-134-0x0000000000810000-0x000000000086F000-memory.dmp

Filesize
380KB

Download
memory/4992-135-0x0000000000810000-0x000000000086F000-memory.dmp

Filesize
380KB

Download