66de662e05a815c7c564e4b3f3da394ebbda6d87ee1fbd32b282dbc737b1240c

Analysis

max time kernel
141s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13/06/2023, 04:29

Target
SecuriteInfo.com.Gen.Variant.Barys.434263.25530.31430.dll
Size 2.4MB
Sample230613-e38qrsfb9v
SHA256 66de662e05a815c7c564e4b3f3da394ebbda6d87ee1fbd32b282dbc737b1240c
MD5 843f2b189e089b832b2bfa96d6c28ce3
SHA1 63c46dedc8f53d1aa21432b2f7f89d19454402f4
SHA512 51782c8cdf0a9a2d8734bf13534270856c69a2ab9dcbb78535a3721535a261a8c84e57ea804b7cb930755bd897a11117ee9dc246813a3b563320838eeed122ef
SSDEEP 49152:2vrs3D6TUdgBzeJYebqE4qchWry2hnKv+R7jizoL5laI3x:Q+OBSbqE5kWrBn8+R0
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1268-55-0x0000000073960000-0x00000000740A2000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1516	1268	WerFault.exe	9

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 1516	1268	rundll32.exe	28
PID 1268 wrote to memory of 1516	1268	rundll32.exe	28
PID 1268 wrote to memory of 1516	1268	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Barys.434263.25530.31430.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1268 -s 228
  2⤵
  - Program crash
  PID:1516

memory/1268-54-0x00000000740B0000-0x00000000747F2000-memory.dmp

Download

memory/1268-55-0x0000000073960000-0x00000000740A2000-memory.dmp

Download