a3778eeda7b459a576b7689e6740fb66d7512a015c68e0310fa538aed2070a00

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 16:54

Target

a3778eeda7b459a576b7689e6740fb66d7512a015c68e0310fa538aed2070a00.dll
Size

124KB
MD5

9cf55f9c01b5ac5263704d704b8a3ce9
SHA1

600d1d2fed7bded50b7f89004849e20fc54dfd5a
SHA256

a3778eeda7b459a576b7689e6740fb66d7512a015c68e0310fa538aed2070a00
SHA512

962869f13ef7dbcc38e378f2732f2ffb58940b35577223bb275dff7f20edc9d02f6426f82d042e3df6f0113ba3ab55cf39c786b32346e5febc260a8bd5e81178
SSDEEP

3072:3wwpKkoo9c+nvYc2Yn25KozC+VWH39K4+m4HgIbrRj+8SOlD:Awp6o9fngE2oozZVWHt8F

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2552-133-0x0000000000400000-0x000000000045F000-memory.dmp	upx
behavioral2/memory/2552-134-0x0000000000400000-0x000000000045F000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3324	2552	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 2552	1408	rundll32.exe	82
PID 1408 wrote to memory of 2552	1408	rundll32.exe	82
PID 1408 wrote to memory of 2552	1408	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3778eeda7b459a576b7689e6740fb66d7512a015c68e0310fa538aed2070a00.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3778eeda7b459a576b7689e6740fb66d7512a015c68e0310fa538aed2070a00.dll,#1
  2⤵
  PID:2552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 1016
    3⤵
    - Program crash
    PID:3324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2552 -ip 2552
1⤵
PID:1200

memory/2552-133-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2552-134-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download