88e5fd4acf71675edec075b8b1d85b5b01180a650e5450587709bbd87c3bda51

Analysis

max time kernel
32s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 19:32

Target

88e5fd4acf71675edec075b8b1d85b5b01180a650e5450587709bbd87c3bda51.dll
Size

16KB
MD5

06a25a137aa201a81aeab664ea8d8bc0
SHA1

3cd5acf2976238838d48f41a69f7a47dba2b7b65
SHA256

88e5fd4acf71675edec075b8b1d85b5b01180a650e5450587709bbd87c3bda51
SHA512

e84047da6caeb408cf1f6c5f8246f623bea8d2f86e9315c5778e82c5289541e92cc20c817f1b332e79bb6270da9b33e972ecd85a4b94b116b6f013c9f7736e38
SSDEEP

384:S9a7L+KQ6B1WiXZopmPgzXmRYElh1LB9RTlnXLRbzlXr:SYW6rGpUIJmLNlXFb5

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/600-56-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1292	600	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 600	548	rundll32.exe	27
PID 548 wrote to memory of 600	548	rundll32.exe	27
PID 548 wrote to memory of 600	548	rundll32.exe	27
PID 548 wrote to memory of 600	548	rundll32.exe	27
PID 548 wrote to memory of 600	548	rundll32.exe	27
PID 548 wrote to memory of 600	548	rundll32.exe	27
PID 548 wrote to memory of 600	548	rundll32.exe	27
PID 600 wrote to memory of 1292	600	rundll32.exe	28
PID 600 wrote to memory of 1292	600	rundll32.exe	28
PID 600 wrote to memory of 1292	600	rundll32.exe	28
PID 600 wrote to memory of 1292	600	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\88e5fd4acf71675edec075b8b1d85b5b01180a650e5450587709bbd87c3bda51.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\88e5fd4acf71675edec075b8b1d85b5b01180a650e5450587709bbd87c3bda51.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 600 -s 228
    3⤵
    - Program crash
    PID:1292

memory/600-55-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download
memory/600-56-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download