c5d45ce8f5c3be82e5ecc060b8eb4e469584ef7c227852fc58bf300ac9a7fae8

Analysis

max time kernel
112s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 07:45

Target

c5d45ce8f5c3be82e5ecc060b8eb4e469584ef7c227852fc58bf300ac9a7fae8.dll
Size

170KB
MD5

3a9bf0b4b32a78016649ba2ee6c04eee
SHA1

bda33471b99fae190c95137a54d3f3c0f6bfe3f8
SHA256

c5d45ce8f5c3be82e5ecc060b8eb4e469584ef7c227852fc58bf300ac9a7fae8
SHA512

73fc2fd7232a34bc60fea5a7dfc2dbf5d86507a996976bf64c05fb42b2f0902e37b62d41b8ccf221eac9ff2228ac9348e751c135229ad315ac69b14467bc4299
SSDEEP

3072:DvcCUevFdKvBJZ+PtNyikGRadrT0VLLoOWVqjJSt1DieOOS1VmRa0FiR3X:DvcMsVviXqrT0VIV4EieODnmRw3X

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4844-133-0x0000000010000000-0x0000000010086000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4288	4844	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 4844	848	rundll32.exe	82
PID 848 wrote to memory of 4844	848	rundll32.exe	82
PID 848 wrote to memory of 4844	848	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5d45ce8f5c3be82e5ecc060b8eb4e469584ef7c227852fc58bf300ac9a7fae8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5d45ce8f5c3be82e5ecc060b8eb4e469584ef7c227852fc58bf300ac9a7fae8.dll,#1
  2⤵
  PID:4844
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 612
    3⤵
    - Program crash
    PID:4288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4844 -ip 4844
1⤵
PID:2224

memory/4844-133-0x0000000010000000-0x0000000010086000-memory.dmp

Filesize
536KB

Download