e267340b1eba536dede221322869507ef5d85c069b959a238586942b657aa039

Analysis

max time kernel
181s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 15:11

Target

0329e4f489bf2eeedaf8e904bbf92e0b.dll
Size

60KB
MD5

0329e4f489bf2eeedaf8e904bbf92e0b
SHA1

f330eff35d7ec52e3e835f99328edb289618d79f
SHA256

e267340b1eba536dede221322869507ef5d85c069b959a238586942b657aa039
SHA512

4d801e8e377e7034db8676b12216e53c55226d08e78753e53f3f1890814ac549fc9b3dbb340b35a9c69f48a65027d462a79e98fb8430e74da97a536b33b0adfb
SSDEEP

768:N/Fa7kSKWbcE/mFOQGeBuzZ/4MARSd5uPkF0AAssYN:N/Fa7kSJcQeW8uzZ/4Mr+6AZk

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3476-0-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3476-1-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
380	3476	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 3476	4520	rundll32.exe	88
PID 4520 wrote to memory of 3476	4520	rundll32.exe	88
PID 4520 wrote to memory of 3476	4520	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0329e4f489bf2eeedaf8e904bbf92e0b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0329e4f489bf2eeedaf8e904bbf92e0b.dll,#1
  2⤵
  PID:3476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 580
    3⤵
    - Program crash
    PID:380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3476 -ip 3476
1⤵
PID:2424

memory/3476-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3476-1-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download