f7145872db6ec51c9394f3cd75c735b077a3dc2154f7f3ca0edc64cf08dfd336

Analysis

max time kernel
148s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 06:57

Target

f7145872db6ec51c9394f3cd75c735b077a3dc2154f7f3ca0edc64cf08dfd336.dll
Size

16KB
MD5

dd5b68edf43c90541dd7c0d9f3193420
SHA1

098a998d6368bc6e297b0bc3cfa7d95710e49ca2
SHA256

f7145872db6ec51c9394f3cd75c735b077a3dc2154f7f3ca0edc64cf08dfd336
SHA512

b28fc536ad09932d5f80b78f44bcb1f1942e4c86ddbca9198ab5cbf20a1697cedbb5a5390b1125f6046df3ef9efe6fbf8ba79da17f14db09242bfde6c54b32c6
SSDEEP

384:S9a7L+KQ6B1WiXZopmPgzXmRYElh1LB9RTlnXLRbzlh:SYW6rGpUIJmLNlXFbv

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4316-133-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4864	4316	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 4316	1716	rundll32.exe	83
PID 1716 wrote to memory of 4316	1716	rundll32.exe	83
PID 1716 wrote to memory of 4316	1716	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7145872db6ec51c9394f3cd75c735b077a3dc2154f7f3ca0edc64cf08dfd336.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7145872db6ec51c9394f3cd75c735b077a3dc2154f7f3ca0edc64cf08dfd336.dll,#1
  2⤵
  PID:4316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 600
    3⤵
    - Program crash
    PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4316 -ip 4316
1⤵
PID:4940

memory/4316-132-0x0000000000000000-mapping.dmp

Download
memory/4316-133-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download