32d66777685297b7849e06c4443db505118f5b27b1778a24d7f52cf95a38b3a1

Analysis

max time kernel
141s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
26-05-2023 23:36

Target

SecuriteInfo.com.Trojan.TR.Dropper.Gen.12987.dll
Size

30KB
MD5

a0054590443700e02876b91cc7ce8938
SHA1

395778b4a2caf0403850ab9c22a3dd8755163a1c
SHA256

32d66777685297b7849e06c4443db505118f5b27b1778a24d7f52cf95a38b3a1
SHA512

29f0aef544f330cf9126a0e1e70d5b192731dab231ff9c2b2dddc362253a33a4d9f709fbdcf61f94fe426fe6ed195a90776e7dbfa04d8ebc35b88f7097dac744
SSDEEP

768:w8cYkfPv8cSBhCxiNLcYJz/3jyD26kN25Q8:wyk3mBVNL93zS5Q

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1484-54-0x0000000010000000-0x0000000010016000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
828	1484	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 1484	1216	rundll32.exe	28
PID 1216 wrote to memory of 1484	1216	rundll32.exe	28
PID 1216 wrote to memory of 1484	1216	rundll32.exe	28
PID 1216 wrote to memory of 1484	1216	rundll32.exe	28
PID 1216 wrote to memory of 1484	1216	rundll32.exe	28
PID 1216 wrote to memory of 1484	1216	rundll32.exe	28
PID 1216 wrote to memory of 1484	1216	rundll32.exe	28
PID 1484 wrote to memory of 828	1484	rundll32.exe	29
PID 1484 wrote to memory of 828	1484	rundll32.exe	29
PID 1484 wrote to memory of 828	1484	rundll32.exe	29
PID 1484 wrote to memory of 828	1484	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.TR.Dropper.Gen.12987.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.TR.Dropper.Gen.12987.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 228
    3⤵
    - Program crash
    PID:828

memory/1484-54-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download