2d2de4ec2f4138384d7c8e418fcc9d92f73fee6f80b06152b304ade7473b0db8

Analysis

max time kernel
147s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 02:56

Target

25636e3b6aa7ba435d1f89bc33a47ca6.dll
Size

277KB
MD5

25636e3b6aa7ba435d1f89bc33a47ca6
SHA1

c9d5b0927685cd82588eb239f84f5023da8a9513
SHA256

2d2de4ec2f4138384d7c8e418fcc9d92f73fee6f80b06152b304ade7473b0db8
SHA512

7c8551cb772b4e6827e0330c2a911a07bc487c9d35f00a3cb4d242688098213878bbb7c1887ac2921172f10870578f3c58284964e9908849fb331a523a50cc26
SSDEEP

6144:ATNGQJOFWypMTG2sUA/uv1YkD1cfpvhk4CfiMO9crXz0AcwjoSv:cJOR6TG2sl/AhKxvhkHDH8cjoSv

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2240-0-0x0000000010000000-0x00000000100A3000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3404	2240	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 2240	5108	rundll32.exe	14
PID 5108 wrote to memory of 2240	5108	rundll32.exe	14
PID 5108 wrote to memory of 2240	5108	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\25636e3b6aa7ba435d1f89bc33a47ca6.dll,#1
1⤵
PID:2240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 572
  2⤵
  - Program crash
  PID:3404

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\25636e3b6aa7ba435d1f89bc33a47ca6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2240 -ip 2240
1⤵
PID:4760

memory/2240-0-0x0000000010000000-0x00000000100A3000-memory.dmp

Filesize
652KB

Download