d013cae1e77291e719022d0066dcdb0057e048f2a1d592b584a6384b2a2e4eac

Analysis

max time kernel
56s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 17:49

Target

d013cae1e77291e719022d0066dcdb0057e048f2a1d592b584a6384b2a2e4eac.dll
Size

16KB
MD5

0f083eafa23b66204efb00fc83774f00
SHA1

0ec083dffba270b8b22da8b7ba76c98f5996fce6
SHA256

d013cae1e77291e719022d0066dcdb0057e048f2a1d592b584a6384b2a2e4eac
SHA512

0b1eec9d01ffa9685019acbf5413a5098cb28a4387e0848710fc3e6ac12e495305e98222f8dc9881b5e7753e9c426b70bdab2a765191cce60e157e388bf8bf11
SSDEEP

384:S9a7L+KQ6B1WiXZopmPgzXmRYElh1LB9RTlnXLRbzl9:SYW6rGpUIJmLNlXFbf

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1552-57-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1752	1552	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 1552	1508	rundll32.exe	28
PID 1508 wrote to memory of 1552	1508	rundll32.exe	28
PID 1508 wrote to memory of 1552	1508	rundll32.exe	28
PID 1508 wrote to memory of 1552	1508	rundll32.exe	28
PID 1508 wrote to memory of 1552	1508	rundll32.exe	28
PID 1508 wrote to memory of 1552	1508	rundll32.exe	28
PID 1508 wrote to memory of 1552	1508	rundll32.exe	28
PID 1552 wrote to memory of 1752	1552	rundll32.exe	29
PID 1552 wrote to memory of 1752	1552	rundll32.exe	29
PID 1552 wrote to memory of 1752	1552	rundll32.exe	29
PID 1552 wrote to memory of 1752	1552	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d013cae1e77291e719022d0066dcdb0057e048f2a1d592b584a6384b2a2e4eac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d013cae1e77291e719022d0066dcdb0057e048f2a1d592b584a6384b2a2e4eac.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 228
    3⤵
    - Program crash
    PID:1752

memory/1552-54-0x0000000000000000-mapping.dmp

Download
memory/1552-55-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/1552-57-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1752-56-0x0000000000000000-mapping.dmp

Download