b736674f58febc22e7cf9a99cadce478b09287a2fcf6a520f153cfafb525c029

Analysis

max time kernel
91s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 23:17

Target

b736674f58febc22e7cf9a99cadce478b09287a2fcf6a520f153cfafb525c029.dll
Size

32KB
MD5

1bde2cf7c130dea0557cd716c5df2021
SHA1

6c851a820984e860967df1ff3cae4a817fc222fa
SHA256

b736674f58febc22e7cf9a99cadce478b09287a2fcf6a520f153cfafb525c029
SHA512

bf7e9d7d4d47329bb8b4b985ddee5c8cc7e7f9d793a0482e5217dcef682b6c753f17cc877dd0a4dcf63e4a89f7ff7259dfb895183c74503c4722ef9e35e9c198
SSDEEP

768:3cR5YBJjVUqk08Y99ZA5n/KnyEE2Osoa0W:M8WqkjGqnREdO+3

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4944-133-0x00000000006E0000-0x00000000006F8000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1504	4944	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 4944	3868	rundll32.exe	81
PID 3868 wrote to memory of 4944	3868	rundll32.exe	81
PID 3868 wrote to memory of 4944	3868	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b736674f58febc22e7cf9a99cadce478b09287a2fcf6a520f153cfafb525c029.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b736674f58febc22e7cf9a99cadce478b09287a2fcf6a520f153cfafb525c029.dll,#1
  2⤵
  PID:4944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 576
    3⤵
    - Program crash
    PID:1504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 4944 -ip 4944
1⤵
PID:4580

memory/4944-133-0x00000000006E0000-0x00000000006F8000-memory.dmp

Filesize
96KB

Download