d90ce625be389a6ff60a288848e52fdfdcb23da9e87fda8661b2a2c4112af448

Analysis

max time kernel
19s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 17:49

Target

d90ce625be389a6ff60a288848e52fdfdcb23da9e87fda8661b2a2c4112af448.dll
Size

16KB
MD5

6fc78139d413f3cbec760607e55e8fb0
SHA1

67f6000363542a170852dd8ede44007ea2bbaf2a
SHA256

d90ce625be389a6ff60a288848e52fdfdcb23da9e87fda8661b2a2c4112af448
SHA512

46768f561c319e39b45a04e7aef02711412e34c0117e02fcac036765d438a6673321931b882fc92ad5422b51fcbfbfd8c80750f28562624ffd7b686225a9f09d
SSDEEP

384:S9a7L+KQ6B1WiXZopmPgzXmRYElh1LB9RTlnXLRbzlzX:SYW6rGpUIJmLNlXFbZX

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/916-56-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
972	916	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 916	2004	rundll32.exe	27
PID 2004 wrote to memory of 916	2004	rundll32.exe	27
PID 2004 wrote to memory of 916	2004	rundll32.exe	27
PID 2004 wrote to memory of 916	2004	rundll32.exe	27
PID 2004 wrote to memory of 916	2004	rundll32.exe	27
PID 2004 wrote to memory of 916	2004	rundll32.exe	27
PID 2004 wrote to memory of 916	2004	rundll32.exe	27
PID 916 wrote to memory of 972	916	rundll32.exe	28
PID 916 wrote to memory of 972	916	rundll32.exe	28
PID 916 wrote to memory of 972	916	rundll32.exe	28
PID 916 wrote to memory of 972	916	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d90ce625be389a6ff60a288848e52fdfdcb23da9e87fda8661b2a2c4112af448.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d90ce625be389a6ff60a288848e52fdfdcb23da9e87fda8661b2a2c4112af448.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 228
    3⤵
    - Program crash
    PID:972

memory/916-55-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/916-56-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download