32d66777685297b7849e06c4443db505118f5b27b1778a24d7f52cf95a38b3a1

Analysis

max time kernel
135s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2023, 23:36

Target

SecuriteInfo.com.Trojan.TR.Dropper.Gen.12987.dll
Size

30KB
MD5

a0054590443700e02876b91cc7ce8938
SHA1

395778b4a2caf0403850ab9c22a3dd8755163a1c
SHA256

32d66777685297b7849e06c4443db505118f5b27b1778a24d7f52cf95a38b3a1
SHA512

29f0aef544f330cf9126a0e1e70d5b192731dab231ff9c2b2dddc362253a33a4d9f709fbdcf61f94fe426fe6ed195a90776e7dbfa04d8ebc35b88f7097dac744
SSDEEP

768:w8cYkfPv8cSBhCxiNLcYJz/3jyD26kN25Q8:wyk3mBVNL93zS5Q

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/868-133-0x0000000010000000-0x0000000010016000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5072	868	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 868	4256	rundll32.exe	81
PID 4256 wrote to memory of 868	4256	rundll32.exe	81
PID 4256 wrote to memory of 868	4256	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.TR.Dropper.Gen.12987.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.TR.Dropper.Gen.12987.dll,#1
  2⤵
  PID:868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 572
    3⤵
    - Program crash
    PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 868 -ip 868
1⤵
PID:4968

memory/868-133-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download