bc57c16dda383dc39c9e93c2c39e80916f860742a33056770c0a0c09bf45ed63

Analysis

max time kernel
163s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 00:59

Target

095257db541c326126b0643b922d4cbd.dll
Size

18KB
MD5

095257db541c326126b0643b922d4cbd
SHA1

9aae8623f1db7d2577c7973a4673717a48f2844d
SHA256

bc57c16dda383dc39c9e93c2c39e80916f860742a33056770c0a0c09bf45ed63
SHA512

1b58e1503892704d50637726609a989eb7e549ef5c60e58aeef90f0082bc2c74e55b14fcb26eca1246b181e26c12d299f785c011c05914a4814923d13cea52f9
SSDEEP

384:RHR43aToTJt6Lg6Ega1cfDpfzKugWAHLfNotjbOvG:Z2KauGga18zKDHLFGjbK

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3036-0-0x0000000010000000-0x0000000010011000-memory.dmp	upx
behavioral2/memory/3036-1-0x0000000010000000-0x0000000010011000-memory.dmp	upx
behavioral2/memory/3036-2-0x0000000010000000-0x0000000010011000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4316	3036	WerFault.exe	87

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3036	rundll32.exe
3036	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 3036	2180	rundll32.exe	87
PID 2180 wrote to memory of 3036	2180	rundll32.exe	87
PID 2180 wrote to memory of 3036	2180	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\095257db541c326126b0643b922d4cbd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\095257db541c326126b0643b922d4cbd.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 572
    3⤵
    - Program crash
    PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3036 -ip 3036
1⤵
PID:2768

memory/3036-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/3036-1-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/3036-2-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download