6e0ca4003bd4b89e301687de13b056ee217b7af225a632bce2caa567152861e6

Analysis

max time kernel
171s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 07:53

Target

6e0ca4003bd4b89e301687de13b056ee217b7af225a632bce2caa567152861e6.dll
Size

612KB
MD5

0db60af73e34a4ba09de3b1558dd514d
SHA1

13017cddef7cc47b7d71b06b70c3d6e7074f5e40
SHA256

6e0ca4003bd4b89e301687de13b056ee217b7af225a632bce2caa567152861e6
SHA512

8843943c290ad6d34e6d2452747a04f7469d1f36567cdb50df9866d0817b65b185a6c3dc4a5fa07e8250054c080292199eddb3f90af51ea17038042e4979ebf7
SSDEEP

12288:QzA5lZhy6RpB/6eXMVVLrkwTzCunpKI13YEqWFzoV2wIn3:QzA5HhRPSeX2VHkuzRnpz1owzoV+

Score

8^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
2748	rundll32mgr.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/files/0x0007000000022e18-136.dat	upx
behavioral2/files/0x0007000000022e18-135.dat	upx
behavioral2/memory/2748-138-0x0000000000400000-0x0000000000475000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1044	856	WerFault.exe	79
3748	2748	WerFault.exe	80

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 856	2448	rundll32.exe	79
PID 2448 wrote to memory of 856	2448	rundll32.exe	79
PID 2448 wrote to memory of 856	2448	rundll32.exe	79
PID 856 wrote to memory of 2748	856	rundll32.exe	80
PID 856 wrote to memory of 2748	856	rundll32.exe	80
PID 856 wrote to memory of 2748	856	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6e0ca4003bd4b89e301687de13b056ee217b7af225a632bce2caa567152861e6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6e0ca4003bd4b89e301687de13b056ee217b7af225a632bce2caa567152861e6.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:856
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    PID:2748
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 272
      4⤵
      Program crash
      PID:3748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 608
    3⤵
    - Program crash
    PID:1044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2748 -ip 2748
1⤵
PID:4040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 856 -ip 856
1⤵
PID:260

C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
201KB

MD5
7b4a2b65b51c60e60ea130369f40c738

SHA1
8d7f4bc58939c4e4baf1ce06deafb680b8d11499

SHA256
de51bdd32b29b065f51ea411e75069e7d1c45409a88377537b048c1c3de2ceab

SHA512
d74b5f5ec59ec34f030e1f4772f917e286b9e725df2a1a09f9c4c9e61b97455b573ce95b593e392c3903ad8120c5a43670251d8a7353dc6a3c2e239b5b68a583

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
201KB

MD5
7b4a2b65b51c60e60ea130369f40c738

SHA1
8d7f4bc58939c4e4baf1ce06deafb680b8d11499

SHA256
de51bdd32b29b065f51ea411e75069e7d1c45409a88377537b048c1c3de2ceab

SHA512
d74b5f5ec59ec34f030e1f4772f917e286b9e725df2a1a09f9c4c9e61b97455b573ce95b593e392c3903ad8120c5a43670251d8a7353dc6a3c2e239b5b68a583

Download Submit
memory/856-133-0x0000000000000000-mapping.dmp

Download
memory/856-137-0x0000000074CA0000-0x0000000074D3F000-memory.dmp

Filesize
636KB

Download
memory/2748-134-0x0000000000000000-mapping.dmp

Download
memory/2748-138-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download