5998a0ebfef8c590b91af758b9874561f38c8af326047deadfeffac899885a1e

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
06/06/2023, 08:16

Target

5998a0ebfef8c590b91af758b9874561f38c8af326047deadfeffac899885a1e.dll
Size

2.8MB
MD5

5e3b6d9f431d5aa9381ea3ec786a8512
SHA1

a68890063b75dccf643d265e8e6402542d73f73b
SHA256

5998a0ebfef8c590b91af758b9874561f38c8af326047deadfeffac899885a1e
SHA512

2c2cedec24f0dff23d9d5528c0bd881d09a55303bbeaf582d5cc5a46aed6b0be61e7d80e292db5046fa2a9425d5d22873141e92bd5a9826e3d1558c0de8954ed
SSDEEP

49152:FVXrzKffB41H6HMxV+s8KuqGaX0ToIBAUZLYD:buffB8HiJBAUZL

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1724-54-0x0000000000290000-0x00000000002B7000-memory.dmp	upx
behavioral1/memory/1724-55-0x0000000000290000-0x00000000002B7000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1328	1724	WerFault.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1724	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1724	1732	rundll32.exe	28
PID 1732 wrote to memory of 1724	1732	rundll32.exe	28
PID 1732 wrote to memory of 1724	1732	rundll32.exe	28
PID 1732 wrote to memory of 1724	1732	rundll32.exe	28
PID 1732 wrote to memory of 1724	1732	rundll32.exe	28
PID 1732 wrote to memory of 1724	1732	rundll32.exe	28
PID 1732 wrote to memory of 1724	1732	rundll32.exe	28
PID 1724 wrote to memory of 1328	1724	rundll32.exe	29
PID 1724 wrote to memory of 1328	1724	rundll32.exe	29
PID 1724 wrote to memory of 1328	1724	rundll32.exe	29
PID 1724 wrote to memory of 1328	1724	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5998a0ebfef8c590b91af758b9874561f38c8af326047deadfeffac899885a1e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5998a0ebfef8c590b91af758b9874561f38c8af326047deadfeffac899885a1e.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 292
    3⤵
    - Program crash
    PID:1328

memory/1724-54-0x0000000000290000-0x00000000002B7000-memory.dmp

Filesize
156KB

Download
memory/1724-55-0x0000000000290000-0x00000000002B7000-memory.dmp

Filesize
156KB

Download