e141dfc05ea821775ef7c4e337d6468ebb68572c8a90d8704d62873db0ef949c

Analysis

max time kernel
134s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2023, 06:28

Target
SecuriteInfo.com.W32.Agent.CE13.tr.5254.32139.dll
Size 3.7MB
Sample230709-g8bz4aah94
SHA256 e141dfc05ea821775ef7c4e337d6468ebb68572c8a90d8704d62873db0ef949c
MD5 aca8199513333f5f293e4465cd72c954
SHA1 6830b0174f89472a3822446df2371692fa766ac7
SHA512 e920635b7e76aeab5230ce864cb7cb43dbfcbf8e8ead2d3256a04d2ad59d5d748e4040baadcf493ab5715a1a28b83ec19d102e5d8491ee190e3647d011dcf07e
SSDEEP 49152:V4tj+s8KuqGaX0ToIBAUZLYHx+KwWJdbS0Bib3wf:+mJBAUZL+x+KwWJxZaU
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1448-133-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1448-134-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1012	1448	WerFault.exe	84

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1448	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 1448	4048	rundll32.exe	84
PID 4048 wrote to memory of 1448	4048	rundll32.exe	84
PID 4048 wrote to memory of 1448	4048	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Agent.CE13.tr.5254.32139.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Agent.CE13.tr.5254.32139.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 644
    3⤵
    - Program crash
    PID:1012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 1448 -ip 1448
1⤵
PID:4676

memory/1448-133-0x0000000010000000-0x000000001003E000-memory.dmp

Download

memory/1448-134-0x0000000010000000-0x000000001003E000-memory.dmp

Download