86305eba1c608eafd02be80088bd4fbd39e0d21263343da8feee45b6d0df064f

Analysis

max time kernel
198s
max time network
212s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 01:49

Target

86305eba1c608eafd02be80088bd4fbd39e0d21263343da8feee45b6d0df064f.dll
Size

98KB
MD5

c1c20474fd43a182b0851cbb374fd474
SHA1

50efcf736f31419098e82b84ef9cb71e197b3f5e
SHA256

86305eba1c608eafd02be80088bd4fbd39e0d21263343da8feee45b6d0df064f
SHA512

9c858b0dbb49458cc1112d76803add8fe0ee0c9aa1c2ed2d4dd5411812fe89e33696f5f6d363e554934f25433a5694e344b19ce8dc2115ed8614e3ac37b0ca5a
SSDEEP

1536:ek9dfLc5z2G5BN9u/cJ/3uCWHPCt8pDf8Zgvo9qVn2QA7354CCLlW:ek9pcBN9u/cJfuCr8pbnes2n7pb

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2680-133-0x0000000010000000-0x000000001002C000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4532	2680	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 2680	832	rundll32.exe	83
PID 832 wrote to memory of 2680	832	rundll32.exe	83
PID 832 wrote to memory of 2680	832	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\86305eba1c608eafd02be80088bd4fbd39e0d21263343da8feee45b6d0df064f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\86305eba1c608eafd02be80088bd4fbd39e0d21263343da8feee45b6d0df064f.dll,#1
  2⤵
  PID:2680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 544
    3⤵
    - Program crash
    PID:4532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2680 -ip 2680
1⤵
PID:1172

memory/2680-133-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download