ab0413fb159602aeaee3b761c822bb179c9c949f780b2c5f7bb5cdb978ed0bd4

Analysis

max time kernel
151s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13/06/2023, 04:29

Target
SecuriteInfo.com.Gen.Variant.Barys.434263.28497.26812.dll
Size 1.8MB
Sample230613-e38qrsef56
SHA256 ab0413fb159602aeaee3b761c822bb179c9c949f780b2c5f7bb5cdb978ed0bd4
MD5 b42d99e223db12e20b424d56fa27017a
SHA1 d2969a286adb832b074b5bf3378d0a082a29ef29
SHA512 23702f7573f555efb21a60083560bf9ea632e2a4f6b2d5b82b2f8e5878a5c568639b4954f5ee1f096d62668c763e1ac40258e27de4b25ed091d441edd7c606da
SSDEEP 49152:2vrs3D6TUdgBzeJYebqE4qchWry2hnKv+:Q+OBSbqE5kWrBn8+
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1240-55-0x00000000744F0000-0x0000000074C32000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1616	1240	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 1616	1240	rundll32.exe	27
PID 1240 wrote to memory of 1616	1240	rundll32.exe	27
PID 1240 wrote to memory of 1616	1240	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Barys.434263.28497.26812.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1240 -s 228
  2⤵
  - Program crash
  PID:1616

memory/1240-54-0x0000000074C40000-0x0000000075382000-memory.dmp

Download

memory/1240-55-0x00000000744F0000-0x0000000074C32000-memory.dmp

Download

memory/1240-56-0x0000000074C40000-0x0000000075382000-memory.dmp

Download