44bef2e9777216494d72005804aeb0db565d467ca68c1cb34be5e984f5768c71

Analysis

max time kernel
142s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2023, 16:00

Target

44bef2e9777216494d72005804aeb0db565d467ca68c1cb34be5e984f5768c71.dll
Size

189KB
MD5

bb47f696fcecf06265d90a3c5747a8b2
SHA1

d154cf58a0f8ccdb309696c63fd8bf9740d55f8c
SHA256

44bef2e9777216494d72005804aeb0db565d467ca68c1cb34be5e984f5768c71
SHA512

ef77527b2b0637f047fdbf15ad11ee82ab16721da45491a0988dce14985ac5b49f0a1b1dac2bb5558024b9f36145436795ccbcb5e0ea0f8be2ed5fb0f7f73162
SSDEEP

3072:FjB3UkpquSNj39ZwjqgeUl1MvZv79m/wKtGlKPgbY+CJyUKLXOLwbMPMZdpIH:tB3UkpquSNzLwxeWsZj9WuGTyUGOcbM/

Score

7^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
4964	rundll32mgr.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/files/0x00090000000224ad-3.dat	upx
behavioral2/files/0x00090000000224ad-4.dat	upx
behavioral2/memory/4964-5-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral2/memory/4964-7-0x0000000000400000-0x000000000045B000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2296	4964	WerFault.exe	89

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 616	3396	rundll32.exe	88
PID 3396 wrote to memory of 616	3396	rundll32.exe	88
PID 3396 wrote to memory of 616	3396	rundll32.exe	88
PID 616 wrote to memory of 4964	616	rundll32.exe	89
PID 616 wrote to memory of 4964	616	rundll32.exe	89
PID 616 wrote to memory of 4964	616	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44bef2e9777216494d72005804aeb0db565d467ca68c1cb34be5e984f5768c71.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\44bef2e9777216494d72005804aeb0db565d467ca68c1cb34be5e984f5768c71.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:616
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    PID:4964
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 264
      4⤵
      Program crash
      PID:2296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4964 -ip 4964
1⤵
PID:4376

C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
105KB

MD5
dfb5daabb95dcfad1a5faf9ab1437076

SHA1
4a199569a9b52911bee7fb19ab80570cc5ff9ed1

SHA256
54282ec29d4993ed6e9972122cfbb70bba4898a21d527bd9e72a166d7ec2fdc0

SHA512
5d31c34403ab5f8db4a6d84f2b5579d4ea18673914b626d78e458a648ac20ddd8e342818e807331036d7bb064f596a02b9737acac42fbead29260343a30717e8

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
105KB

MD5
dfb5daabb95dcfad1a5faf9ab1437076

SHA1
4a199569a9b52911bee7fb19ab80570cc5ff9ed1

SHA256
54282ec29d4993ed6e9972122cfbb70bba4898a21d527bd9e72a166d7ec2fdc0

SHA512
5d31c34403ab5f8db4a6d84f2b5579d4ea18673914b626d78e458a648ac20ddd8e342818e807331036d7bb064f596a02b9737acac42fbead29260343a30717e8

Download Submit
memory/616-1-0x0000000074D30000-0x0000000074D64000-memory.dmp

Filesize
208KB

Download
memory/4964-5-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4964-6-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/4964-7-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download