4c736c3660695d303248d0b9edd1b2fd48822cb27b066c58908ba5a22e0aa65f

Analysis

max time kernel
173s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 18:12

Target

002325c6d5ff1184320cb9d86750b53a.dll
Size

201KB
MD5

002325c6d5ff1184320cb9d86750b53a
SHA1

27b40c67cc44675169603ef175f04af1d118b090
SHA256

4c736c3660695d303248d0b9edd1b2fd48822cb27b066c58908ba5a22e0aa65f
SHA512

95e50cc5cd7c9b5f725811a42c1b9429b2dbf10f5208cfbb69364b356c252109d04d4611a998dcb6a6329171592c5256db675432d5e3f9af51ce768a9d51baf7
SSDEEP

3072:wKR2KgWgZBNdePSY6b8ByUP5XEbZOjL10Wv9W/KyEW80VQcKd:jR/m3du6b8ByWXIu1XVq80V

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/1216-0-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral2/memory/1216-2-0x0000000000400000-0x000000000044D000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2588 1216 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2588	1216	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4504 wrote to memory of 1216	4504	rundll32.exe	rundll32.exe
PID 4504 wrote to memory of 1216	4504	rundll32.exe	rundll32.exe
PID 4504 wrote to memory of 1216	4504	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\002325c6d5ff1184320cb9d86750b53a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4504

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\002325c6d5ff1184320cb9d86750b53a.dll,#1
2⤵
PID:1216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 572
3⤵
- Program crash
PID:2588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1216 -ip 1216
1⤵
PID:4764

memory/1216-0-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1216-1-0x0000000000B40000-0x0000000000B55000-memory.dmp

Filesize
84KB

Download
memory/1216-2-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download