fd5f350b862091328967376f1bc3d40cc25c27fbac0867b885015e322a472861

Analysis

max time kernel
29s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 19:30

Target

fd5f350b862091328967376f1bc3d40cc25c27fbac0867b885015e322a472861.dll
Size

16KB
MD5

7f691f6f2ab04e681f50c7b248cefa10
SHA1

446bc2812791ac315caba76d56617381a51625c2
SHA256

fd5f350b862091328967376f1bc3d40cc25c27fbac0867b885015e322a472861
SHA512

90757647b24f0c6fc73f150fbeec79c3af39d6bd487aabc5810f36631421b269f60170508e510f08e3292ebfaccb3599eb8d7e1150bf3a2de1def508792162f0
SSDEEP

384:S9a7L+KQ6B1WiXZopmPgzXmRYElh1LB9RTlnXLRbzlf:SYW6rGpUIJmLNlXFbJ

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/696-56-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1868	696	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 696	1644	rundll32.exe	27
PID 1644 wrote to memory of 696	1644	rundll32.exe	27
PID 1644 wrote to memory of 696	1644	rundll32.exe	27
PID 1644 wrote to memory of 696	1644	rundll32.exe	27
PID 1644 wrote to memory of 696	1644	rundll32.exe	27
PID 1644 wrote to memory of 696	1644	rundll32.exe	27
PID 1644 wrote to memory of 696	1644	rundll32.exe	27
PID 696 wrote to memory of 1868	696	rundll32.exe	28
PID 696 wrote to memory of 1868	696	rundll32.exe	28
PID 696 wrote to memory of 1868	696	rundll32.exe	28
PID 696 wrote to memory of 1868	696	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd5f350b862091328967376f1bc3d40cc25c27fbac0867b885015e322a472861.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd5f350b862091328967376f1bc3d40cc25c27fbac0867b885015e322a472861.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:696
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 696 -s 228
    3⤵
    - Program crash
    PID:1868

memory/696-55-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download
memory/696-56-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download