f87602a332f87faff4b089b397e1d895e4e49e235eb6343dfaabd0977bed3146

Analysis

max time kernel
91s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 06:03

Target

109a7de7bdc40c42d1c2d41293c861cf.dll
Size

278KB
MD5

109a7de7bdc40c42d1c2d41293c861cf
SHA1

18eec358a1b2e5f11f2af13cc48d78e806a23db6
SHA256

f87602a332f87faff4b089b397e1d895e4e49e235eb6343dfaabd0977bed3146
SHA512

108ba2cc0882b40ac2ff8671165204d324195524db6961b5f4bed9027d7e555749ccdcaad5ca9c045b9580adddf8df07033676811d6aab4b51fe5f2ce4187720
SSDEEP

6144:8p8KF7rf3n3wLYgBb5yGsu2eT0tArw1NEwIR1KEF4K/DRos3oSC:8p8KFPgRB1yG3240tACEbUsXDRoaoSC

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/448-0-0x0000000010000000-0x00000000100A3000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4568	448	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 448	4828	rundll32.exe	87
PID 4828 wrote to memory of 448	4828	rundll32.exe	87
PID 4828 wrote to memory of 448	4828	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\109a7de7bdc40c42d1c2d41293c861cf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\109a7de7bdc40c42d1c2d41293c861cf.dll,#1
  2⤵
  PID:448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 560
    3⤵
    - Program crash
    PID:4568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 448 -ip 448
1⤵
PID:1108

memory/448-0-0x0000000010000000-0x00000000100A3000-memory.dmp

Filesize
652KB

Download