d96b7d3e5b78844e4d63381ea64def1517f470ef7716df9586e75fdf6a58c20d

Analysis

max time kernel
52s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 00:33

Target

d96b7d3e5b78844e4d63381ea64def1517f470ef7716df9586e75fdf6a58c20d.dll
Size

79KB
MD5

c43f173ba50158d0bc716cc7900c9bd6
SHA1

8036c683f7bd937447cf9e72d94abeb5bceb9cb4
SHA256

d96b7d3e5b78844e4d63381ea64def1517f470ef7716df9586e75fdf6a58c20d
SHA512

2b433b5a71ad62de441aecc6a57f80b1bbd6fa326f0f7eeebafcb402657468e7696adfd8c32343d3db5fa23a81b40a7d8c3ad404676073f1ef4f81d059ef4419
SSDEEP

768:VhAR0QxZn6x2fa3YCYaEeZhJ6W8nciSljIQl/hmeAZL7ScXN7Xp72hJxqm8E5S1p:VhAln6fjYuvec/GQUZSAXp72hJxqm/5o

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/940-133-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1240	940	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 940	868	rundll32.exe	80
PID 868 wrote to memory of 940	868	rundll32.exe	80
PID 868 wrote to memory of 940	868	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d96b7d3e5b78844e4d63381ea64def1517f470ef7716df9586e75fdf6a58c20d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d96b7d3e5b78844e4d63381ea64def1517f470ef7716df9586e75fdf6a58c20d.dll,#1
  2⤵
  PID:940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 572
    3⤵
    - Program crash
    PID:1240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 940 -ip 940
1⤵
PID:1684

memory/940-133-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download