55d6b169ecb629d87ac6b5a6e49be04a0b8ae7812862f2743d7af398cadbdf6f

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 14:19

Target

006045c9e828de79741bdaac206bc0a1.dll
Size

1.9MB
MD5

006045c9e828de79741bdaac206bc0a1
SHA1

72740678f44834192045554a0c6c16155668061d
SHA256

55d6b169ecb629d87ac6b5a6e49be04a0b8ae7812862f2743d7af398cadbdf6f
SHA512

94224c637559048dcfa8a4440ae4a6bafee86a36813e35dbf50e522d941094cfc6e1acc916899a9eca600f0608d73598027b56d7f4a0321a28b5a8dc7aadd81d
SSDEEP

49152:wbnxFd3pl6hh8G8ga/HwTkmEF1gju500+Rz/6XjhsdGGDXTREYes:gfd3Ghh8G8z/wAmS1gjum066X1vOjREQ

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2600-0-0x0000000010000000-0x0000000010303000-memory.dmp	upx
behavioral2/memory/2600-1-0x0000000010000000-0x0000000010303000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3088	2600	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 2600	1796	rundll32.exe	88
PID 1796 wrote to memory of 2600	1796	rundll32.exe	88
PID 1796 wrote to memory of 2600	1796	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\006045c9e828de79741bdaac206bc0a1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\006045c9e828de79741bdaac206bc0a1.dll,#1
  2⤵
  PID:2600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 660
    3⤵
    - Program crash
    PID:3088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2600 -ip 2600
1⤵
PID:1476

memory/2600-0-0x0000000010000000-0x0000000010303000-memory.dmp

Filesize
3.0MB

Download
memory/2600-1-0x0000000010000000-0x0000000010303000-memory.dmp

Filesize
3.0MB

Download