e5dc9cacee44fc125ada6c16b69f037f5a950f03bcdc4857298e598d17099b0e

Analysis

max time kernel
141s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 12:08

Target

180e5fd478c61b02020500577d3285ee.dll
Size

215KB
MD5

180e5fd478c61b02020500577d3285ee
SHA1

7418fc8a26c44718c25f7a60ffb7d5eb4d7cd705
SHA256

e5dc9cacee44fc125ada6c16b69f037f5a950f03bcdc4857298e598d17099b0e
SHA512

8e2bb3ea8a47e901b9f9cdcfc645abf0c11643d3c2492fd8e3ab69c9c83a39b6ce59ae738bccfcbe075bc4707aaf32e51aba04446ac1ca89ff4068b2d29f61f7
SSDEEP

3072:oPz8LDdv02rPUe7ZIf3aJzZc1lS8gV775CNXlALW657+tBO12B4daq/fiQVt:oyDdM2oe+a41lc97E7s7Haq/fL

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4536-0-0x0000000000400000-0x0000000000456000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3404 4536 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3404	4536	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1752 wrote to memory of 4536	1752	rundll32.exe	rundll32.exe
PID 1752 wrote to memory of 4536	1752	rundll32.exe	rundll32.exe
PID 1752 wrote to memory of 4536	1752	rundll32.exe	rundll32.exe

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\180e5fd478c61b02020500577d3285ee.dll,#1
1⤵
PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 568
2⤵
- Program crash
PID:3404

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\180e5fd478c61b02020500577d3285ee.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4536 -ip 4536
1⤵
PID:1856

memory/4536-0-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4536-1-0x00000000007E0000-0x00000000007F4000-memory.dmp

Filesize
80KB

Download