88e5fd4acf71675edec075b8b1d85b5b01180a650e5450587709bbd87c3bda51

Analysis

max time kernel
63s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 19:32

Target

88e5fd4acf71675edec075b8b1d85b5b01180a650e5450587709bbd87c3bda51.dll
Size

16KB
MD5

06a25a137aa201a81aeab664ea8d8bc0
SHA1

3cd5acf2976238838d48f41a69f7a47dba2b7b65
SHA256

88e5fd4acf71675edec075b8b1d85b5b01180a650e5450587709bbd87c3bda51
SHA512

e84047da6caeb408cf1f6c5f8246f623bea8d2f86e9315c5778e82c5289541e92cc20c817f1b332e79bb6270da9b33e972ecd85a4b94b116b6f013c9f7736e38
SSDEEP

384:S9a7L+KQ6B1WiXZopmPgzXmRYElh1LB9RTlnXLRbzlXr:SYW6rGpUIJmLNlXFb5

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4396-133-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1536	4396	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 4396	400	rundll32.exe	82
PID 400 wrote to memory of 4396	400	rundll32.exe	82
PID 400 wrote to memory of 4396	400	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\88e5fd4acf71675edec075b8b1d85b5b01180a650e5450587709bbd87c3bda51.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\88e5fd4acf71675edec075b8b1d85b5b01180a650e5450587709bbd87c3bda51.dll,#1
  2⤵
  PID:4396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 600
    3⤵
    - Program crash
    PID:1536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4396 -ip 4396
1⤵
PID:4288

memory/4396-133-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download