4c736c3660695d303248d0b9edd1b2fd48822cb27b066c58908ba5a22e0aa65f

Analysis

max time kernel
173s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 18:12

Target

002325c6d5ff1184320cb9d86750b53a.dll
Size

201KB
MD5

002325c6d5ff1184320cb9d86750b53a
SHA1

27b40c67cc44675169603ef175f04af1d118b090
SHA256

4c736c3660695d303248d0b9edd1b2fd48822cb27b066c58908ba5a22e0aa65f
SHA512

95e50cc5cd7c9b5f725811a42c1b9429b2dbf10f5208cfbb69364b356c252109d04d4611a998dcb6a6329171592c5256db675432d5e3f9af51ce768a9d51baf7
SSDEEP

3072:wKR2KgWgZBNdePSY6b8ByUP5XEbZOjL10Wv9W/KyEW80VQcKd:jR/m3du6b8ByWXIu1XVq80V

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1216-0-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral2/memory/1216-2-0x0000000000400000-0x000000000044D000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2588	1216	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 1216	4504	rundll32.exe	88
PID 4504 wrote to memory of 1216	4504	rundll32.exe	88
PID 4504 wrote to memory of 1216	4504	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\002325c6d5ff1184320cb9d86750b53a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\002325c6d5ff1184320cb9d86750b53a.dll,#1
  2⤵
  PID:1216
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 572
    3⤵
    - Program crash
    PID:2588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1216 -ip 1216
1⤵
PID:4764

memory/1216-0-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1216-1-0x0000000000B40000-0x0000000000B55000-memory.dmp

Filesize
84KB

Download
memory/1216-2-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download