14f2bb023e9829a0209141759a88126d346f3bf1121c5c400d8719b060ec8cfb

Analysis

max time kernel
141s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12/06/2023, 21:28

Target

SecuriteInfo.com.Gen.Variant.Barys.434263.28885.16557.dll
Size

2.9MB
MD5

2aafe032ccd444188c61238a7e665de0
SHA1

20845d8e9c7a580a0d0747046b98f884e7152380
SHA256

14f2bb023e9829a0209141759a88126d346f3bf1121c5c400d8719b060ec8cfb
SHA512

0d2d6e66ce48a08e3bf812fcf59de9191453b0b3493ee30b32afe59567db879450d54ec9e28a9346d6c839bbc30d53c9370f133aa6211bb0bb277f4f78e5e3f2
SSDEEP

49152:fCnZ5YeC0e32WlWa03UZOAibh8CyNb6TKGWeaJmVN7jizoL5laI3x:fC7/9qzlWa03UY8C49Uz0

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2000-55-0x0000000073940000-0x00000000741F1000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2012	2000	WerFault.exe	18

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2012	2000	rundll32.exe	28
PID 2000 wrote to memory of 2012	2000	rundll32.exe	28
PID 2000 wrote to memory of 2012	2000	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Barys.434263.28885.16557.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2000 -s 228
  2⤵
  - Program crash
  PID:2012

memory/2000-54-0x0000000074200000-0x0000000074AB1000-memory.dmp

Filesize
8.7MB

Download
memory/2000-55-0x0000000073940000-0x00000000741F1000-memory.dmp

Filesize
8.7MB

Download
memory/2000-56-0x0000000074200000-0x0000000074AB1000-memory.dmp

Filesize
8.7MB

Download