37469d024209c2f4c3dd34a5c1b8289b44a98cca4dc0732ddf58af1097c98aa0

Analysis

max time kernel
140s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 01:56

Target

238e363e81e40ce2993ef270b33f7620.dll
Size

104KB
MD5

238e363e81e40ce2993ef270b33f7620
SHA1

85069cf163aba79e977a96a029adbf14e5ae90e3
SHA256

37469d024209c2f4c3dd34a5c1b8289b44a98cca4dc0732ddf58af1097c98aa0
SHA512

d67f46538329d94988f825f080ef5d575053e1a91cc68e5ebb8361e2903e3088cfa1b7ae3ff7a10f1be4b01d0d302e91ff43f649d72566703580aae677087498
SSDEEP

1536:mkJvFEhpEWiQW8xs53Nkqe5gEynSaj86WxheW4BsFdH9XHAxrhV7EAKGJI:mkJNEhOW1W3u95gtfZ8he76HkrvjXy

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2532-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx
behavioral2/memory/2532-1-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1496	2532	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 2532	3268	rundll32.exe	88
PID 3268 wrote to memory of 2532	3268	rundll32.exe	88
PID 3268 wrote to memory of 2532	3268	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\238e363e81e40ce2993ef270b33f7620.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\238e363e81e40ce2993ef270b33f7620.dll,#1
  2⤵
  PID:2532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 592
    3⤵
    - Program crash
    PID:1496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2532 -ip 2532
1⤵
PID:1660

memory/2532-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2532-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download