7ee242154db712755ab126e84571aedfd62378a8d00538d23b162aeb79238f05

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 06:39

Target

5a32af7bbc65c347bcf1f451b9bb27d1.dll
Size

176KB
MD5

5a32af7bbc65c347bcf1f451b9bb27d1
SHA1

18507ce92360d97cf78d5e8520ace7410860ba64
SHA256

7ee242154db712755ab126e84571aedfd62378a8d00538d23b162aeb79238f05
SHA512

db6a4c8d0600a0b3883c66fbdf5960f4751cf2a0258a3ea7ee5c7922992bf8bb226ece33ff38b21fc5a9bfc4b7904fafb0fbf2069b8a492130c12e8eb60ef7a5
SSDEEP

3072:+JUvYJUKUnq5qCo0TmX6cCIFYuEar4KzdBLVYwE34qr3Iakyzv4jZH+cN4:+u0NqCV8SXuB0KJ/E345aVzQjZ+cN4

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2008-0-0x0000000010000000-0x0000000010088000-memory.dmp	upx
behavioral2/memory/2008-1-0x0000000010000000-0x0000000010088000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4356	2008	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2008	2484	rundll32.exe	14
PID 2484 wrote to memory of 2008	2484	rundll32.exe	14
PID 2484 wrote to memory of 2008	2484	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a32af7bbc65c347bcf1f451b9bb27d1.dll,#1
1⤵
PID:2008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 612
  2⤵
  - Program crash
  PID:4356

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a32af7bbc65c347bcf1f451b9bb27d1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2008 -ip 2008
1⤵
PID:3840

memory/2008-0-0x0000000010000000-0x0000000010088000-memory.dmp

Filesize
544KB

Download
memory/2008-1-0x0000000010000000-0x0000000010088000-memory.dmp

Filesize
544KB

Download