3f122bee753762566fd28608a1b861dd3e7b1945e923382d0a47d13aac3bc1e6

Analysis

max time kernel
142s
max time network
126s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
14/11/2023, 10:04

Target

NEAS.3f122bee753762566fd28608a1b861dd3e7b1945e923382d0a47d13aac3bc1e6.dll
Size

599KB
MD5

291eafd5104938b405952e1b8d07aa90
SHA1

321f19fabc8a333d951e0f53c69dba887b44b246
SHA256

3f122bee753762566fd28608a1b861dd3e7b1945e923382d0a47d13aac3bc1e6
SHA512

d2c797a825d44b74daf02e43c4d94aa64dba78459f54c19ac7cfb5ee9ea302547ba92ad380ddcff0790d8c7a8f122855de17db666adc567f5413a695e8a45f1b
SSDEEP

6144:+RR5rhZFQGrsUwF7vlPoS/MXXnDX543KrBhEve9j9IRqqDLuy2xTBLu:+R5nWFpPoSKzG3aJIsqnuy2xT1u

Score

7^/10

upx

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2008-0-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2008-1-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2008-2-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2008-3-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2008-4-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2008-5-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2008-6-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2196	2008	WerFault.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2008	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 2008	536	rundll32.exe	28
PID 536 wrote to memory of 2008	536	rundll32.exe	28
PID 536 wrote to memory of 2008	536	rundll32.exe	28
PID 536 wrote to memory of 2008	536	rundll32.exe	28
PID 536 wrote to memory of 2008	536	rundll32.exe	28
PID 536 wrote to memory of 2008	536	rundll32.exe	28
PID 536 wrote to memory of 2008	536	rundll32.exe	28
PID 2008 wrote to memory of 2196	2008	rundll32.exe	29
PID 2008 wrote to memory of 2196	2008	rundll32.exe	29
PID 2008 wrote to memory of 2196	2008	rundll32.exe	29
PID 2008 wrote to memory of 2196	2008	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.3f122bee753762566fd28608a1b861dd3e7b1945e923382d0a47d13aac3bc1e6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.3f122bee753762566fd28608a1b861dd3e7b1945e923382d0a47d13aac3bc1e6.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 252
    3⤵
    - Program crash
    PID:2196

memory/2008-0-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2008-1-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2008-2-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2008-3-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2008-4-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2008-5-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2008-6-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download