7a0a403ed5f196a851e4d0d6cdec48f9378a70c71df1b812742109951289a2ec

Analysis

max time kernel
91s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 19:33

Target

7a0a403ed5f196a851e4d0d6cdec48f9378a70c71df1b812742109951289a2ec.dll
Size

16KB
MD5

0f57b4a0d87b18cbb14651ac956b8180
SHA1

d9e5cd3076a6e39c3267584a4f5b25719b08db5a
SHA256

7a0a403ed5f196a851e4d0d6cdec48f9378a70c71df1b812742109951289a2ec
SHA512

a51c8c5232ee96e8478e33a3e7cf90ea3a91a6375c9fedc1d834aea07577dea64c07c547181bd0a39ced1718040d2c561c56d7b8bbab7464132894f38e583b45
SSDEEP

384:S9a7L+KQ6B1WiXZopmPgzXmRYElh1LB9RTlnXLRbzlC:SYW6rGpUIJmLNlXFbI

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2584-133-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1704	2584	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 2584	1332	rundll32.exe	80
PID 1332 wrote to memory of 2584	1332	rundll32.exe	80
PID 1332 wrote to memory of 2584	1332	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a0a403ed5f196a851e4d0d6cdec48f9378a70c71df1b812742109951289a2ec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a0a403ed5f196a851e4d0d6cdec48f9378a70c71df1b812742109951289a2ec.dll,#1
  2⤵
  PID:2584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 604
    3⤵
    - Program crash
    PID:1704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2584 -ip 2584
1⤵
PID:976

memory/2584-133-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download