d90ce625be389a6ff60a288848e52fdfdcb23da9e87fda8661b2a2c4112af448

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 17:49

Target

d90ce625be389a6ff60a288848e52fdfdcb23da9e87fda8661b2a2c4112af448.dll
Size

16KB
MD5

6fc78139d413f3cbec760607e55e8fb0
SHA1

67f6000363542a170852dd8ede44007ea2bbaf2a
SHA256

d90ce625be389a6ff60a288848e52fdfdcb23da9e87fda8661b2a2c4112af448
SHA512

46768f561c319e39b45a04e7aef02711412e34c0117e02fcac036765d438a6673321931b882fc92ad5422b51fcbfbfd8c80750f28562624ffd7b686225a9f09d
SSDEEP

384:S9a7L+KQ6B1WiXZopmPgzXmRYElh1LB9RTlnXLRbzlzX:SYW6rGpUIJmLNlXFbZX

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2296-133-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5108	2296	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 2296	1632	rundll32.exe	79
PID 1632 wrote to memory of 2296	1632	rundll32.exe	79
PID 1632 wrote to memory of 2296	1632	rundll32.exe	79

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d90ce625be389a6ff60a288848e52fdfdcb23da9e87fda8661b2a2c4112af448.dll,#1
1⤵
PID:2296
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 600
  2⤵
  - Program crash
  PID:5108

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d90ce625be389a6ff60a288848e52fdfdcb23da9e87fda8661b2a2c4112af448.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2296 -ip 2296
1⤵
PID:428

memory/2296-133-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download