baa5ce668a64c8de0b3b5267de708cd976e5346539b835a974f7f5c6341b58c7

Analysis

max time kernel
144s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 18:44

Target

baa5ce668a64c8de0b3b5267de708cd976e5346539b835a974f7f5c6341b58c7.dll
Size

88KB
MD5

0f1dadce907bdbbb524cc8a7ff7ec530
SHA1

8d47cf4ed765ef5afaca2d5684938fbdc5e6ba76
SHA256

baa5ce668a64c8de0b3b5267de708cd976e5346539b835a974f7f5c6341b58c7
SHA512

acf0388e3d408eadf4e4b2365e814923cfeda9b89cd47456dcb9d44e14c4684185ca16cfea5611dbc27fe191b6bbdf79d0471caac9eed1fbb9231835ce25f0fb
SSDEEP

1536:le2mzKr7Lm+E0uqBhKRs0u3yH3ipacHs/+joHdgaPrMxceCFY7huIdMXGVYyqkuo:le2mz07LIVChKIiTcHsmjSzMSTqN1yXe

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3000-133-0x0000000010000000-0x0000000010028000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1480	3000	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 3000	4384	rundll32.exe	79
PID 4384 wrote to memory of 3000	4384	rundll32.exe	79
PID 4384 wrote to memory of 3000	4384	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\baa5ce668a64c8de0b3b5267de708cd976e5346539b835a974f7f5c6341b58c7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\baa5ce668a64c8de0b3b5267de708cd976e5346539b835a974f7f5c6341b58c7.dll,#1
  2⤵
  PID:3000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 568
    3⤵
    - Program crash
    PID:1480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3000 -ip 3000
1⤵
PID:1440

memory/3000-133-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download