df8392b5cae456af04a15053f687c5990d2adc16e24e9e94bdfc5a82149fe557

Analysis

max time kernel
104s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 14:02

Target

df8392b5cae456af04a15053f687c5990d2adc16e24e9e94bdfc5a82149fe557.dll
Size

33KB
MD5

3206debf829d35cceb0329dfd3c9b590
SHA1

b0f241850fb327b53ab5d5a2c52825025386773d
SHA256

df8392b5cae456af04a15053f687c5990d2adc16e24e9e94bdfc5a82149fe557
SHA512

c1345c5ea29191d687d59363ccaac5f6eebdb4a45119f0525cae1027f9017e4e5b3fb5ff8d82871ce314c8aab9ea9b57dfb9bace9567ff2017e5854355a2c6c7
SSDEEP

768:w41eVCKncAFBpTQf4dvzRsNyLZM6c8zW0JBJlxzIwa5OVCLQnbcuyD7UkAS:h88CLTPdvPMiN3C48LQnouy8kAS

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4876-133-0x0000000010000000-0x0000000010018000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1448	4876	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 4876	4396	rundll32.exe	80
PID 4396 wrote to memory of 4876	4396	rundll32.exe	80
PID 4396 wrote to memory of 4876	4396	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\df8392b5cae456af04a15053f687c5990d2adc16e24e9e94bdfc5a82149fe557.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\df8392b5cae456af04a15053f687c5990d2adc16e24e9e94bdfc5a82149fe557.dll,#1
  2⤵
  PID:4876
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 568
    3⤵
    - Program crash
    PID:1448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4876 -ip 4876
1⤵
PID:4820

memory/4876-133-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download