cecb0732c52040f5b3e7c928911856e27729ef6dfba2aaa4330f8729142189e0

Analysis

max time kernel
65s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2023 19:26

Target

cecb0732c52040f5b3e7c928911856e27729ef6dfba2aaa4330f8729142189e0.dll
Size

736KB
MD5

2a379ac1a65a9ca1153ec00a88ae5882
SHA1

cef33943cd3be1f1bc795faba7027d9a0fee0ed9
SHA256

cecb0732c52040f5b3e7c928911856e27729ef6dfba2aaa4330f8729142189e0
SHA512

dfcc891560b339a10ac189aeaeacf92e2304728d67eea27411b2ee0ae8e6af1f7a194766238afa8b04537f831baac7354771f141a2c878f9e92e287e143145f3
SSDEEP

12288:1oOQsWr7hnaKhoqzkwk7tbl1EBC3YNHJv2G8A//glm:1oOQsWrta+oWW7tbDEBC+v2U/S

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4400-133-0x0000000002060000-0x000000000206B000-memory.dmp	upx
behavioral2/memory/4400-134-0x0000000002060000-0x000000000206B000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1416 4400 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1416	4400	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4924 wrote to memory of 4400	4924	rundll32.exe	rundll32.exe
PID 4924 wrote to memory of 4400	4924	rundll32.exe	rundll32.exe
PID 4924 wrote to memory of 4400	4924	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cecb0732c52040f5b3e7c928911856e27729ef6dfba2aaa4330f8729142189e0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cecb0732c52040f5b3e7c928911856e27729ef6dfba2aaa4330f8729142189e0.dll,#1
  2⤵
  PID:4400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 676
    3⤵
    - Program crash
    PID:1416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4400 -ip 4400
1⤵
PID:4920

memory/4400-133-0x0000000002060000-0x000000000206B000-memory.dmp

Filesize
44KB

Download
memory/4400-134-0x0000000002060000-0x000000000206B000-memory.dmp

Filesize
44KB

Download