7ee242154db712755ab126e84571aedfd62378a8d00538d23b162aeb79238f05

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 06:39

Target

5a32af7bbc65c347bcf1f451b9bb27d1.dll
Size

176KB
MD5

5a32af7bbc65c347bcf1f451b9bb27d1
SHA1

18507ce92360d97cf78d5e8520ace7410860ba64
SHA256

7ee242154db712755ab126e84571aedfd62378a8d00538d23b162aeb79238f05
SHA512

db6a4c8d0600a0b3883c66fbdf5960f4751cf2a0258a3ea7ee5c7922992bf8bb226ece33ff38b21fc5a9bfc4b7904fafb0fbf2069b8a492130c12e8eb60ef7a5
SSDEEP

3072:+JUvYJUKUnq5qCo0TmX6cCIFYuEar4KzdBLVYwE34qr3Iakyzv4jZH+cN4:+u0NqCV8SXuB0KJ/E345aVzQjZ+cN4

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2680-0-0x0000000010000000-0x0000000010088000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1900	2680	WerFault.exe	14

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2680	1628	rundll32.exe	14
PID 1628 wrote to memory of 2680	1628	rundll32.exe	14
PID 1628 wrote to memory of 2680	1628	rundll32.exe	14
PID 1628 wrote to memory of 2680	1628	rundll32.exe	14
PID 1628 wrote to memory of 2680	1628	rundll32.exe	14
PID 1628 wrote to memory of 2680	1628	rundll32.exe	14
PID 1628 wrote to memory of 2680	1628	rundll32.exe	14
PID 2680 wrote to memory of 1900	2680	rundll32.exe	16
PID 2680 wrote to memory of 1900	2680	rundll32.exe	16
PID 2680 wrote to memory of 1900	2680	rundll32.exe	16
PID 2680 wrote to memory of 1900	2680	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a32af7bbc65c347bcf1f451b9bb27d1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 228
  2⤵
  - Program crash
  PID:1900

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a32af7bbc65c347bcf1f451b9bb27d1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1628

memory/2680-0-0x0000000010000000-0x0000000010088000-memory.dmp

Filesize
544KB

Download