d5dc83a56fa63c3efdbc8cc69b33e9fb37e86d273b36c90dbd2e674c47534ecd

Analysis

max time kernel
180s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 01:52

Target

d5dc83a56fa63c3efdbc8cc69b33e9fb37e86d273b36c90dbd2e674c47534ecd.dll
Size

295KB
MD5

bfb47572d8d0261e03e7d8cb6e65aa60
SHA1

e508eb2bd9c831eca0c5908f1bf121f69f820640
SHA256

d5dc83a56fa63c3efdbc8cc69b33e9fb37e86d273b36c90dbd2e674c47534ecd
SHA512

155ef8cd7991bc72471a45185f51301dc3a5d2353b7d28c793276e8f3a29c3df2d06d66b549d7cacaf644f1d3a11849b2c8bcef79c62759f30a34cf085a36d0e
SSDEEP

6144:BCIGPj038tAgFMldWNX+sf5SbL18+RnE1HM:qj038t/FMldW420ZRnT

Score

8^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
112	rundll32mgr.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/files/0x0006000000022e1b-134.dat	upx
behavioral2/files/0x0006000000022e1b-135.dat	upx
behavioral2/memory/112-137-0x0000000000400000-0x0000000000461000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4380	4568	WerFault.exe	83
4272	112	WerFault.exe	84

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 4568	1356	rundll32.exe	83
PID 1356 wrote to memory of 4568	1356	rundll32.exe	83
PID 1356 wrote to memory of 4568	1356	rundll32.exe	83
PID 4568 wrote to memory of 112	4568	rundll32.exe	84
PID 4568 wrote to memory of 112	4568	rundll32.exe	84
PID 4568 wrote to memory of 112	4568	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d5dc83a56fa63c3efdbc8cc69b33e9fb37e86d273b36c90dbd2e674c47534ecd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d5dc83a56fa63c3efdbc8cc69b33e9fb37e86d273b36c90dbd2e674c47534ecd.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    PID:112
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 112 -s 260
      4⤵
      Program crash
      PID:4272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 608
    3⤵
    - Program crash
    PID:4380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4568 -ip 4568
1⤵
PID:320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 112 -ip 112
1⤵
PID:956

C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
129KB

MD5
0344a3aa574e9d0e0f5593ed1b4cb88b

SHA1
951fe2b0b4678199676e71838d91dddf762fa79d

SHA256
93f2949add56ea8f8f063c3b313ee701f57a208021fafbe6aac3e9a43a6f3ded

SHA512
31e4f5a15a7d15938cbd80638230ddb2cc3acd5060d99b4ea061fe1f186e6165755f2724c5bfe7b509a42e4a4612c95920f14d509a3f8c7b68b19e994fa7afdc

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
129KB

MD5
0344a3aa574e9d0e0f5593ed1b4cb88b

SHA1
951fe2b0b4678199676e71838d91dddf762fa79d

SHA256
93f2949add56ea8f8f063c3b313ee701f57a208021fafbe6aac3e9a43a6f3ded

SHA512
31e4f5a15a7d15938cbd80638230ddb2cc3acd5060d99b4ea061fe1f186e6165755f2724c5bfe7b509a42e4a4612c95920f14d509a3f8c7b68b19e994fa7afdc

Download Submit
memory/112-137-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/4568-136-0x0000000010000000-0x000000001004E000-memory.dmp

Filesize
312KB

Download