2ec1e4ae2e847e870fe8d71ac9a6078342d9d7223393ed37c2ee6b19fccb9e52

Analysis

max time kernel
6s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 12:19

Target

2ec1e4ae2e847e870fe8d71ac9a6078342d9d7223393ed37c2ee6b19fccb9e52.dll
Size

225KB
MD5

04982298b8942a9144128b3026218174
SHA1

9737b1f4905398f7373461614ec60073baf628c7
SHA256

2ec1e4ae2e847e870fe8d71ac9a6078342d9d7223393ed37c2ee6b19fccb9e52
SHA512

5bc0f070cc4c433f009d762d7356dd8ef09bcacb26c2fd404ee98798091ed51ed490d8fdb983f882483327163c755931a839e445e81b9d2a18016be11ce7caf9
SSDEEP

6144:EgxgUvn+mwFqT9a5EB535Ru+/x+bfAoSRBl:Xx5+mrJH33jusxvoSR3

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1176-57-0x0000000074920000-0x00000000749A7000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
576	1176	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1176	1704	rundll32.exe	28
PID 1704 wrote to memory of 1176	1704	rundll32.exe	28
PID 1704 wrote to memory of 1176	1704	rundll32.exe	28
PID 1704 wrote to memory of 1176	1704	rundll32.exe	28
PID 1704 wrote to memory of 1176	1704	rundll32.exe	28
PID 1704 wrote to memory of 1176	1704	rundll32.exe	28
PID 1704 wrote to memory of 1176	1704	rundll32.exe	28
PID 1176 wrote to memory of 576	1176	rundll32.exe	29
PID 1176 wrote to memory of 576	1176	rundll32.exe	29
PID 1176 wrote to memory of 576	1176	rundll32.exe	29
PID 1176 wrote to memory of 576	1176	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ec1e4ae2e847e870fe8d71ac9a6078342d9d7223393ed37c2ee6b19fccb9e52.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ec1e4ae2e847e870fe8d71ac9a6078342d9d7223393ed37c2ee6b19fccb9e52.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1176 -s 224
    3⤵
    - Program crash
    PID:576

memory/1176-55-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download
memory/1176-56-0x00000000749B0000-0x0000000074A37000-memory.dmp

Filesize
540KB

Download
memory/1176-57-0x0000000074920000-0x00000000749A7000-memory.dmp

Filesize
540KB

Download
memory/1176-58-0x00000000749B0000-0x0000000074A37000-memory.dmp

Filesize
540KB

Download