146126cfa7bf32a5c31d48b38697ea3c661362c0f5d82a1964af0d19a6247915

Analysis

max time kernel
292s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
02/09/2023, 07:29

Target

node.dll
Size

8.1MB
MD5

04a4b044c29d2e53d4dc5744d19ca974
SHA1

dd29c0e95933f4c359eb83b495c96dd52362d9d2
SHA256

30b85e314bba93c4fd977b1c986d65e24cea08ac8db34c3d8ef1dbb940490667
SHA512

66c5d56acc1fa319b54a8a7ce682dc2babc29cbb885764033b9ac83ba906189a3ebc9eb3a081f6f04470513b5bbe02043b3a7e8f29e7d7646bd9e123a9187bc8
SSDEEP

98304:n5LHoFAEa4PPzCGnNDTm7TLeZbhMN4tBhdBqOFSI9mvexS6KNGYTudCC2spOLNbI:n5LH0hjJnN2wkkB5FrM6KNDAe+ORa5

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral9/memory/2960-2-0x0000000070A10000-0x00000000722C5000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2416	2960	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2960	3028	rundll32.exe	28
PID 3028 wrote to memory of 2960	3028	rundll32.exe	28
PID 3028 wrote to memory of 2960	3028	rundll32.exe	28
PID 3028 wrote to memory of 2960	3028	rundll32.exe	28
PID 3028 wrote to memory of 2960	3028	rundll32.exe	28
PID 3028 wrote to memory of 2960	3028	rundll32.exe	28
PID 3028 wrote to memory of 2960	3028	rundll32.exe	28
PID 2960 wrote to memory of 2416	2960	rundll32.exe	29
PID 2960 wrote to memory of 2416	2960	rundll32.exe	29
PID 2960 wrote to memory of 2416	2960	rundll32.exe	29
PID 2960 wrote to memory of 2416	2960	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\node.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\node.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 252
    3⤵
    - Program crash
    PID:2416

memory/2960-0-0x00000000722D0000-0x0000000073B85000-memory.dmp

Filesize
24.7MB

Download
memory/2960-1-0x00000000722D0000-0x0000000073B85000-memory.dmp

Filesize
24.7MB

Download
memory/2960-2-0x0000000070A10000-0x00000000722C5000-memory.dmp

Filesize
24.7MB

Download
memory/2960-3-0x00000000722D0000-0x0000000073B85000-memory.dmp

Filesize
24.7MB

Download
memory/2960-5-0x00000000722D0000-0x0000000073B85000-memory.dmp

Filesize
24.7MB

Download