e450382d7fdded88ef8b1154eb9385fb3c16f23d6129ffa432f0926e39ce2b1c

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 19:31

Target

e450382d7fdded88ef8b1154eb9385fb3c16f23d6129ffa432f0926e39ce2b1c.dll
Size

16KB
MD5

b0bf2ef7bb27733879827d7ce3241bf0
SHA1

841376fad92c4000a7a4f4f459cb569ca94dd145
SHA256

e450382d7fdded88ef8b1154eb9385fb3c16f23d6129ffa432f0926e39ce2b1c
SHA512

e22f8332f6a4fff3fe8189f3a115cbb4ac4ac98562ebe990fa919566d4dd4017867345f1b96aa64cf4375548e0af0235fbd370954d0d6c308f13571d0a89bab9
SSDEEP

384:S9a7L+KQ6B1WiXZopmPgzXmRYElh1LB9RTlnXLRbzlsc:SYW6rGpUIJmLNlXFbH

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4936-133-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4980	4936	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 4936	5052	rundll32.exe	81
PID 5052 wrote to memory of 4936	5052	rundll32.exe	81
PID 5052 wrote to memory of 4936	5052	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e450382d7fdded88ef8b1154eb9385fb3c16f23d6129ffa432f0926e39ce2b1c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e450382d7fdded88ef8b1154eb9385fb3c16f23d6129ffa432f0926e39ce2b1c.dll,#1
  2⤵
  PID:4936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 600
    3⤵
    - Program crash
    PID:4980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 4936 -ip 4936
1⤵
PID:1344

memory/4936-133-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download