e5fef32be6fc92697260d56d3844f90bcdda0104c4dfbf8988d5aadd8fb60eb0

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 10:28

Target

super-simple-wall-v4.8/Super Simple Wall v4.8/SSW4.8.dll
Size

5KB
MD5

e04448a17b7550427a2f88062a81bc92
SHA1

c72729d9e4e91611d6c3bd15edeb501b9ad53728
SHA256

d181f539fd691a459e73884d91ff273ad4d6b2b88b50fd4da593a2bfd70f94f4
SHA512

1e23b15c14f913ee80b57dbd39807184365a937bccecbd378f9d530f2993d74e46772bb03bb9371f63e9e5f2b80656fe203a15ec1823a008b9b769499e6fd3b6
SSDEEP

96:liNFobSQqyPVY5AaXcAsI5xx552tRA/c1vvw:l6iLVEApAXxTCt1v

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2296-0-0x0000000010000000-0x0000000010009000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2488	2296	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2296	2352	rundll32.exe	14
PID 2352 wrote to memory of 2296	2352	rundll32.exe	14
PID 2352 wrote to memory of 2296	2352	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\super-simple-wall-v4.8\Super Simple Wall v4.8\SSW4.8.dll",#1
1⤵
PID:2296
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 852
  2⤵
  - Program crash
  PID:2488

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\super-simple-wall-v4.8\Super Simple Wall v4.8\SSW4.8.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2296 -ip 2296
1⤵
PID:3652

memory/2296-1-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download
memory/2296-0-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download