961482755b50e298f29d1764c84d03955b7990bead244dc57ddbf864cb1a1194

Analysis

max time kernel
166s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 11:57

Target

961482755b50e298f29d1764c84d03955b7990bead244dc57ddbf864cb1a1194.dll
Size

549KB
MD5

e47aa637281af43d70d338db35d6b2e0
SHA1

087b63d4ef9acaaef61f18d7a392a2c15247c853
SHA256

961482755b50e298f29d1764c84d03955b7990bead244dc57ddbf864cb1a1194
SHA512

274ec092b6285d051607fba6ed7b2a325014d4e1a56c7dfe34f3a5b05678980b15f7d78f1f06660ad77703f78591dcff512fc17ef37707d0aa896f8ee7326dab
SSDEEP

12288:Z/02UBk+89sfGd4QNNOVQbgeie71vYzQ/DKMMy2pc:QBu54aNOVyl7xxWMhs

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4748-133-0x0000000010000000-0x000000001008B000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3696	4748	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 4748	5080	rundll32.exe	81
PID 5080 wrote to memory of 4748	5080	rundll32.exe	81
PID 5080 wrote to memory of 4748	5080	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\961482755b50e298f29d1764c84d03955b7990bead244dc57ddbf864cb1a1194.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\961482755b50e298f29d1764c84d03955b7990bead244dc57ddbf864cb1a1194.dll,#1
  2⤵
  PID:4748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 620
    3⤵
    - Program crash
    PID:3696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 4748 -ip 4748
1⤵
PID:3264

memory/4748-133-0x0000000010000000-0x000000001008B000-memory.dmp

Filesize
556KB

Download