68987f42915a58669f2bd86b3eea2c010af753f3a37b15ea92d885e52e5b6178

Analysis

max time kernel
175s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 12:36

Target

68987f42915a58669f2bd86b3eea2c010af753f3a37b15ea92d885e52e5b6178.dll
Size

301KB
MD5

3916bb9de973fbca89aeff0b9735ff75
SHA1

769d213716d8a28abe9839e83ce07df22b4dcb27
SHA256

68987f42915a58669f2bd86b3eea2c010af753f3a37b15ea92d885e52e5b6178
SHA512

54d5734314425416a2a3bab32814d510f6f58441cf72d0f5881168e544ae3091efb503e2782f8b693d9f44f1cc1b79ebe5c3d80932ce7859b67460c0d4602f9e
SSDEEP

6144:1fvvKKzAYf0L+6i0t+myTC7dQe0gKss4KJJzujIRryZCIXQHedhoMltVM:hvrzAYYj+myTC7UfpfzOIRG3QHejnM

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/5084-133-0x00000000007B0000-0x0000000000896000-memory.dmp	upx
behavioral2/memory/5084-134-0x00000000007B0000-0x0000000000896000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2124 5084 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2124	5084	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4420 wrote to memory of 5084	4420	rundll32.exe	rundll32.exe
PID 4420 wrote to memory of 5084	4420	rundll32.exe	rundll32.exe
PID 4420 wrote to memory of 5084	4420	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\68987f42915a58669f2bd86b3eea2c010af753f3a37b15ea92d885e52e5b6178.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4420

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\68987f42915a58669f2bd86b3eea2c010af753f3a37b15ea92d885e52e5b6178.dll,#1
2⤵
PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 820
3⤵
- Program crash
PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5084 -ip 5084
1⤵
PID:2300

memory/5084-132-0x0000000000000000-mapping.dmp

Download
memory/5084-133-0x00000000007B0000-0x0000000000896000-memory.dmp

Filesize
920KB

Download
memory/5084-134-0x00000000007B0000-0x0000000000896000-memory.dmp

Filesize
920KB

Download