13c71221ff00c38d2f57520169134f85fdebafc451dad3d7d7f39e851f6f8695

Analysis

max time kernel
142s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 01:33

Target

49a5fdbb7990ed3cc04eaa075a798f2d.dll
Size

169KB
MD5

49a5fdbb7990ed3cc04eaa075a798f2d
SHA1

ed3c035d0ceba275aa5596532378f8b0406a81f8
SHA256

13c71221ff00c38d2f57520169134f85fdebafc451dad3d7d7f39e851f6f8695
SHA512

ec15908d93417b9096b788d93b94eada9eb5f17eb577a2511fb01224b05c90603bf5b7558556260b07ea540ea75e171bda42f6f6d033b85f89b39bf2d1b5946e
SSDEEP

3072:MMlvuNXAnLhe41Q0arrQugCtNP8JTJMS8oM+pNRf+t5Hh0NvjKqzCjfRU:MeCXAL5qvlgO18JVMS8oMIRf+J0hkju

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4192-0-0x0000000010000000-0x0000000010085000-memory.dmp	upx
behavioral2/memory/4192-1-0x0000000010000000-0x0000000010085000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2040	4192	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 4192	3716	rundll32.exe	88
PID 3716 wrote to memory of 4192	3716	rundll32.exe	88
PID 3716 wrote to memory of 4192	3716	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\49a5fdbb7990ed3cc04eaa075a798f2d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\49a5fdbb7990ed3cc04eaa075a798f2d.dll,#1
  2⤵
  PID:4192
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 612
    3⤵
    - Program crash
    PID:2040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4192 -ip 4192
1⤵
PID:4732

memory/4192-0-0x0000000010000000-0x0000000010085000-memory.dmp

Filesize
532KB

Download
memory/4192-1-0x0000000010000000-0x0000000010085000-memory.dmp

Filesize
532KB

Download