2761ead814f321b5a5e1d1f51c0e0a28063810d253c2722512667a13b723b42b

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 02:28

Target

2761ead814f321b5a5e1d1f51c0e0a28063810d253c2722512667a13b723b42b.dll
Size

472KB
MD5

d65db2e450b05e2d639f3a680b6b7830
SHA1

56935ce9001c2a31a573fdf2a7c6bd9cb8a43bc1
SHA256

2761ead814f321b5a5e1d1f51c0e0a28063810d253c2722512667a13b723b42b
SHA512

5b127445307aa094d39aa019966a2222f3a130465d98c205634c7706ea8b1618a392591dd0cd0c2bd51b4cc0c1480ef1b28e769ea1ae6880da73064c376bac99
SSDEEP

12288:sehnaNPpSVZmNxRCwnwm3W3OHIIf5Rm8iV:seh0PpS6NxNnwYeOHXX7

Score

8^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
1828	rundll32Srv.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/files/0x0009000000022e0e-134.dat	upx
behavioral2/files/0x0009000000022e0e-135.dat	upx
behavioral2/memory/1828-137-0x0000000000400000-0x000000000045B000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32Srv.exe	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1604	800	WerFault.exe	80

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 800	2008	rundll32.exe	80
PID 2008 wrote to memory of 800	2008	rundll32.exe	80
PID 2008 wrote to memory of 800	2008	rundll32.exe	80
PID 800 wrote to memory of 1828	800	rundll32.exe	81
PID 800 wrote to memory of 1828	800	rundll32.exe	81
PID 800 wrote to memory of 1828	800	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2761ead814f321b5a5e1d1f51c0e0a28063810d253c2722512667a13b723b42b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2761ead814f321b5a5e1d1f51c0e0a28063810d253c2722512667a13b723b42b.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:800
- - C:\Windows\SysWOW64\rundll32Srv.exe
    C:\Windows\SysWOW64\rundll32Srv.exe
    3⤵
    - Executes dropped EXE
    PID:1828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 608
    3⤵
    - Program crash
    PID:1604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 800 -ip 800
1⤵
PID:4224

C:\Windows\SysWOW64\rundll32Srv.exe

Filesize
90KB

MD5
d42b1312a4843705ddb9c9ee6ac1bd2d

SHA1
cbef4dc54b47f09d0ed37200694d62f19d0b249a

SHA256
aa0c1e6acd98bae8e3f3ef38c3d687571ffcea30b2d237fa5015ba9c846afada

SHA512
c8c5c9e5b0a713b754794ba6b24145bd05132b6dde919d28bedb63c600a0e557ce801e5624f18a9ddd7e6a90daa5bdfdac7d0e778fdde1dc6924b9b5f5dfacb6

Download Submit
C:\Windows\SysWOW64\rundll32Srv.exe

Filesize
90KB

MD5
d42b1312a4843705ddb9c9ee6ac1bd2d

SHA1
cbef4dc54b47f09d0ed37200694d62f19d0b249a

SHA256
aa0c1e6acd98bae8e3f3ef38c3d687571ffcea30b2d237fa5015ba9c846afada

SHA512
c8c5c9e5b0a713b754794ba6b24145bd05132b6dde919d28bedb63c600a0e557ce801e5624f18a9ddd7e6a90daa5bdfdac7d0e778fdde1dc6924b9b5f5dfacb6

Download Submit
memory/800-136-0x0000000010000000-0x0000000010078000-memory.dmp

Filesize
480KB

Download
memory/1828-137-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download