af61bf04aae9fd7a538609ddee9d8df1a317eca7108f48007390c99d3bc33e0e

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 12:39

Target

af61bf04aae9fd7a538609ddee9d8df1a317eca7108f48007390c99d3bc33e0e.dll
Size

254KB
MD5

b216c203ef794d241533c8ce9450b4f6
SHA1

f47b350b36cd6e221e2538e8b9114749ece967e3
SHA256

af61bf04aae9fd7a538609ddee9d8df1a317eca7108f48007390c99d3bc33e0e
SHA512

cc6c4a592c4033bc39a874de1408441fef4cb10edbbd3f204fb4aaedd213311b1f6029d62d17c1baf2b9ae2d6afc9ba91a333634a34fef07a19cf6f6e867c8c3
SSDEEP

3072:6if71Y1EYj9uCtTpn2locWXJ3M6ai0IvxAip2KikGwaskppxXvWVUoyBbsX2jO1Y:6if9a9zhxz8K0Iv2kGwaRftbaUCxH8J

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1788-56-0x0000000000280000-0x0000000000330000-memory.dmp	upx
behavioral1/memory/1788-58-0x0000000000280000-0x0000000000330000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2032 1788 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2032	1788	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1188 wrote to memory of 1788	1188	rundll32.exe	rundll32.exe
PID 1188 wrote to memory of 1788	1188	rundll32.exe	rundll32.exe
PID 1188 wrote to memory of 1788	1188	rundll32.exe	rundll32.exe
PID 1188 wrote to memory of 1788	1188	rundll32.exe	rundll32.exe
PID 1188 wrote to memory of 1788	1188	rundll32.exe	rundll32.exe
PID 1188 wrote to memory of 1788	1188	rundll32.exe	rundll32.exe
PID 1188 wrote to memory of 1788	1188	rundll32.exe	rundll32.exe
PID 1788 wrote to memory of 2032	1788	rundll32.exe	WerFault.exe
PID 1788 wrote to memory of 2032	1788	rundll32.exe	WerFault.exe
PID 1788 wrote to memory of 2032	1788	rundll32.exe	WerFault.exe
PID 1788 wrote to memory of 2032	1788	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af61bf04aae9fd7a538609ddee9d8df1a317eca7108f48007390c99d3bc33e0e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1188

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af61bf04aae9fd7a538609ddee9d8df1a317eca7108f48007390c99d3bc33e0e.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 468
3⤵
- Program crash
PID:2032

memory/1788-54-0x0000000000000000-mapping.dmp

Download
memory/1788-55-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1788-56-0x0000000000280000-0x0000000000330000-memory.dmp

Filesize
704KB

Download
memory/1788-58-0x0000000000280000-0x0000000000330000-memory.dmp

Filesize
704KB

Download
memory/2032-57-0x0000000000000000-mapping.dmp

Download