4bd162ddd32e30e88fdc6026a0c7500589cb7c04ce05ec4ed6748fa79a4f20ff

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
05-11-2023 11:49

Target

4bd162ddd32e30e88fdc6026a0c7500589cb7c04ce05ec4ed6748fa79a4f20ff.dll
Size

1.7MB
MD5

67cdb1df99de654315566e738621867d
SHA1

4b1f8a0e4e9811233d360ca634eccfd59c6ba8fd
SHA256

4bd162ddd32e30e88fdc6026a0c7500589cb7c04ce05ec4ed6748fa79a4f20ff
SHA512

fa8ae409ff9f2400499199933a61069099e5cc1a23df13ee07661b92ad0ae91e67d23d3233bdc61c4b206fa3771283840dd39876cead7386c60817ed4cf90363
SSDEEP

49152:MdZIyW2XRosXxsBD+Jb3+1DXBnOBnQBYut6aFiuMcNglw9dN:mbW2h8I+1DXBOlEt60iuMcNglSdN

Score

7^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1276-0-0x0000000010000000-0x00000000104FB000-memory.dmp	upx
behavioral1/memory/1276-1-0x0000000010000000-0x00000000104FB000-memory.dmp	upx
behavioral1/memory/1276-2-0x0000000010000000-0x00000000104FB000-memory.dmp	upx
behavioral1/memory/1276-4-0x0000000010000000-0x00000000104FB000-memory.dmp	upx
behavioral1/memory/1276-6-0x0000000010000000-0x00000000104FB000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HPSocket4C.dll	rundll32.exe
File created	C:\Windows\SysWOW64\rapidjson.dll	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1992	1276	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 1276	2332	rundll32.exe	28
PID 2332 wrote to memory of 1276	2332	rundll32.exe	28
PID 2332 wrote to memory of 1276	2332	rundll32.exe	28
PID 2332 wrote to memory of 1276	2332	rundll32.exe	28
PID 2332 wrote to memory of 1276	2332	rundll32.exe	28
PID 2332 wrote to memory of 1276	2332	rundll32.exe	28
PID 2332 wrote to memory of 1276	2332	rundll32.exe	28
PID 1276 wrote to memory of 1992	1276	rundll32.exe	29
PID 1276 wrote to memory of 1992	1276	rundll32.exe	29
PID 1276 wrote to memory of 1992	1276	rundll32.exe	29
PID 1276 wrote to memory of 1992	1276	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bd162ddd32e30e88fdc6026a0c7500589cb7c04ce05ec4ed6748fa79a4f20ff.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bd162ddd32e30e88fdc6026a0c7500589cb7c04ce05ec4ed6748fa79a4f20ff.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 340
    3⤵
    - Program crash
    PID:1992

memory/1276-0-0x0000000010000000-0x00000000104FB000-memory.dmp

Filesize
5.0MB

Download
memory/1276-1-0x0000000010000000-0x00000000104FB000-memory.dmp

Filesize
5.0MB

Download
memory/1276-2-0x0000000010000000-0x00000000104FB000-memory.dmp

Filesize
5.0MB

Download
memory/1276-4-0x0000000010000000-0x00000000104FB000-memory.dmp

Filesize
5.0MB

Download
memory/1276-6-0x0000000010000000-0x00000000104FB000-memory.dmp

Filesize
5.0MB

Download