4e45113bdfa91deb6cddf6579f40a2471ce152e3fb4b934ccae1a207a1cad724

Analysis

max time kernel
76s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 08:41

Target

变速精灵2.11免费版/dmshell.dll
Size

426KB
MD5

acca075bd2986c863c37ae749b129091
SHA1

3967288f25bfeacaeb84d9ef448beb51762ea1e3
SHA256

5ff5e486db2e60561e4022c905a546da6c15f79d7aff8a54898f335ff55add8c
SHA512

cbc4c26e88a7f049a2905f83b83025912c16338a4a06f0edb9af2e4414f04bb1333e0209c534e333041af2149112d2deb923f9849d96fa91cf2cdc12d76bcb2d
SSDEEP

6144:Y78QhN+FCh39g12bd0qURrg8XEpHbzTGonzqGzlCUlk98dxXQWqaLKQEy3fRP4+3:G/B3O17pzUpHzGYCA3y7QEy35PNXn

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral16/memory/2320-133-0x0000000010000000-0x0000000010118000-memory.dmp	upx
behavioral16/memory/2320-134-0x0000000010000000-0x0000000010118000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5068	2320	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 2320	876	rundll32.exe	80
PID 876 wrote to memory of 2320	876	rundll32.exe	80
PID 876 wrote to memory of 2320	876	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\变速精灵2.11免费版\dmshell.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\变速精灵2.11免费版\dmshell.dll,#1
  2⤵
  PID:2320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 612
    3⤵
    - Program crash
    PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 2320 -ip 2320
1⤵
PID:3184

memory/2320-132-0x0000000000000000-mapping.dmp

Download
memory/2320-133-0x0000000010000000-0x0000000010118000-memory.dmp

Filesize
1.1MB

Download
memory/2320-134-0x0000000010000000-0x0000000010118000-memory.dmp

Filesize
1.1MB

Download