93e10b73bd1edd3e5df1e7169411dbc51f336e8f31535ec378777ce4bbaadf17

Analysis

max time kernel
187s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 22:46

Target

93e10b73bd1edd3e5df1e7169411dbc51f336e8f31535ec378777ce4bbaadf17.dll
Size

187KB
MD5

f411b221d85ebbee850f7df1ebaf6a28
SHA1

cc73a0aa6224d7ae8af41b08a94288bceb59747c
SHA256

93e10b73bd1edd3e5df1e7169411dbc51f336e8f31535ec378777ce4bbaadf17
SHA512

996f7b95e7db719766f97538834c127f10b9978b7276e3b52ef7343ba5eb6b4a84072b802eab423154de3f5a4783c4f3ab5cd52e16ba3bf8068126bd23dd5afd
SSDEEP

3072:qjmC06c2pJtXewQ8uODOhnEaGFZKV1NMMJvc8ewZqNH1cHyz4KsIXOih++Le7Stt:qHnpTH4nEaGFYV1N7Jv5uVcSb377Le7O

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/916-133-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral2/memory/916-134-0x0000000000400000-0x000000000044A000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1012	916	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 916	1316	rundll32.exe	83
PID 1316 wrote to memory of 916	1316	rundll32.exe	83
PID 1316 wrote to memory of 916	1316	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\93e10b73bd1edd3e5df1e7169411dbc51f336e8f31535ec378777ce4bbaadf17.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\93e10b73bd1edd3e5df1e7169411dbc51f336e8f31535ec378777ce4bbaadf17.dll,#1
  2⤵
  PID:916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 588
    3⤵
    - Program crash
    PID:1012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 916 -ip 916
1⤵
PID:3524

memory/916-133-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/916-134-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download