961482755b50e298f29d1764c84d03955b7990bead244dc57ddbf864cb1a1194

Analysis

max time kernel
25s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 11:57

Target

961482755b50e298f29d1764c84d03955b7990bead244dc57ddbf864cb1a1194.dll
Size

549KB
MD5

e47aa637281af43d70d338db35d6b2e0
SHA1

087b63d4ef9acaaef61f18d7a392a2c15247c853
SHA256

961482755b50e298f29d1764c84d03955b7990bead244dc57ddbf864cb1a1194
SHA512

274ec092b6285d051607fba6ed7b2a325014d4e1a56c7dfe34f3a5b05678980b15f7d78f1f06660ad77703f78591dcff512fc17ef37707d0aa896f8ee7326dab
SSDEEP

12288:Z/02UBk+89sfGd4QNNOVQbgeie71vYzQ/DKMMy2pc:QBu54aNOVyl7xxWMhs

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/968-57-0x0000000010000000-0x000000001008B000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
960	968	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 968	1728	rundll32.exe	28
PID 1728 wrote to memory of 968	1728	rundll32.exe	28
PID 1728 wrote to memory of 968	1728	rundll32.exe	28
PID 1728 wrote to memory of 968	1728	rundll32.exe	28
PID 1728 wrote to memory of 968	1728	rundll32.exe	28
PID 1728 wrote to memory of 968	1728	rundll32.exe	28
PID 1728 wrote to memory of 968	1728	rundll32.exe	28
PID 968 wrote to memory of 960	968	rundll32.exe	29
PID 968 wrote to memory of 960	968	rundll32.exe	29
PID 968 wrote to memory of 960	968	rundll32.exe	29
PID 968 wrote to memory of 960	968	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\961482755b50e298f29d1764c84d03955b7990bead244dc57ddbf864cb1a1194.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\961482755b50e298f29d1764c84d03955b7990bead244dc57ddbf864cb1a1194.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 968 -s 228
    3⤵
    - Program crash
    PID:960

memory/960-56-0x0000000000000000-mapping.dmp

Download
memory/968-54-0x0000000000000000-mapping.dmp

Download
memory/968-55-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download
memory/968-57-0x0000000010000000-0x000000001008B000-memory.dmp

Filesize
556KB

Download