fd5f350b862091328967376f1bc3d40cc25c27fbac0867b885015e322a472861

Analysis

max time kernel
101s
max time network
4s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 19:30

Target

fd5f350b862091328967376f1bc3d40cc25c27fbac0867b885015e322a472861.dll
Size

16KB
MD5

7f691f6f2ab04e681f50c7b248cefa10
SHA1

446bc2812791ac315caba76d56617381a51625c2
SHA256

fd5f350b862091328967376f1bc3d40cc25c27fbac0867b885015e322a472861
SHA512

90757647b24f0c6fc73f150fbeec79c3af39d6bd487aabc5810f36631421b269f60170508e510f08e3292ebfaccb3599eb8d7e1150bf3a2de1def508792162f0
SSDEEP

384:S9a7L+KQ6B1WiXZopmPgzXmRYElh1LB9RTlnXLRbzlf:SYW6rGpUIJmLNlXFbJ

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2840-133-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2352	2840	WerFault.exe	75
3628	2840	WerFault.exe	75

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 2840	1880	rundll32.exe	75
PID 1880 wrote to memory of 2840	1880	rundll32.exe	75
PID 1880 wrote to memory of 2840	1880	rundll32.exe	75
PID 2840 wrote to memory of 2352	2840	rundll32.exe	78
PID 2840 wrote to memory of 2352	2840	rundll32.exe	78
PID 2840 wrote to memory of 2352	2840	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd5f350b862091328967376f1bc3d40cc25c27fbac0867b885015e322a472861.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd5f350b862091328967376f1bc3d40cc25c27fbac0867b885015e322a472861.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 600
    3⤵
    - Program crash
    PID:2352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 600
    3⤵
    - Program crash
    PID:3628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2840 -ip 2840
1⤵
PID:4348

memory/2840-133-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download