94c32474249acb4a1e123c9a7f8890eecf5e54bca785fa9482bc99e6def20d0a

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 07:54

Target

12b9e1d71739eb99bb02be37887f5cce.dll
Size

209KB
MD5

12b9e1d71739eb99bb02be37887f5cce
SHA1

d0467809d8053270750003d0d9ab1ac44427b26a
SHA256

94c32474249acb4a1e123c9a7f8890eecf5e54bca785fa9482bc99e6def20d0a
SHA512

bad415f00c58e8264cfba1417ff1914ef99d1c67281ddf174cdd1405a8ccaacfef5a62fb68a7b6a0017ab778b3cf809e2f695949b8c8a7456558ac6d6194957a
SSDEEP

6144:s3TfWTH0hrZsCX/qB8wEOvn5uTwIPAShhPtkEQH2j3EYCrUE:lTgZsCv48Evc0IPAkkwTjCrp

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4884-0-0x0000000000400000-0x0000000000455000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1372	4884	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 4884	1420	rundll32.exe	14
PID 1420 wrote to memory of 4884	1420	rundll32.exe	14
PID 1420 wrote to memory of 4884	1420	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12b9e1d71739eb99bb02be37887f5cce.dll,#1
1⤵
PID:4884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 548
  2⤵
  - Program crash
  PID:1372

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12b9e1d71739eb99bb02be37887f5cce.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4884 -ip 4884
1⤵
PID:1876

memory/4884-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4884-1-0x0000000002920000-0x0000000002934000-memory.dmp

Filesize
80KB

Download