5998a0ebfef8c590b91af758b9874561f38c8af326047deadfeffac899885a1e

Analysis

max time kernel
82s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2023, 08:16

Target

5998a0ebfef8c590b91af758b9874561f38c8af326047deadfeffac899885a1e.dll
Size

2.8MB
MD5

5e3b6d9f431d5aa9381ea3ec786a8512
SHA1

a68890063b75dccf643d265e8e6402542d73f73b
SHA256

5998a0ebfef8c590b91af758b9874561f38c8af326047deadfeffac899885a1e
SHA512

2c2cedec24f0dff23d9d5528c0bd881d09a55303bbeaf582d5cc5a46aed6b0be61e7d80e292db5046fa2a9425d5d22873141e92bd5a9826e3d1558c0de8954ed
SSDEEP

49152:FVXrzKffB41H6HMxV+s8KuqGaX0ToIBAUZLYD:buffB8HiJBAUZL

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1296-133-0x00000000020A0000-0x00000000020C7000-memory.dmp	upx
behavioral2/memory/1296-134-0x00000000020A0000-0x00000000020C7000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3868	1296	WerFault.exe	86

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1296	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 1296	2432	rundll32.exe	86
PID 2432 wrote to memory of 1296	2432	rundll32.exe	86
PID 2432 wrote to memory of 1296	2432	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5998a0ebfef8c590b91af758b9874561f38c8af326047deadfeffac899885a1e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5998a0ebfef8c590b91af758b9874561f38c8af326047deadfeffac899885a1e.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1296
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 716
    3⤵
    - Program crash
    PID:3868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1296 -ip 1296
1⤵
PID:4184

memory/1296-133-0x00000000020A0000-0x00000000020C7000-memory.dmp

Filesize
156KB

Download
memory/1296-134-0x00000000020A0000-0x00000000020C7000-memory.dmp

Filesize
156KB

Download