66b7669750ea11f7f97c623915c45d6f18a6a1d6e0fe5c5bb4b34a4348939ac5

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 14:25

Target

39c1cbd78cd251c3e0518ca99ff599f0.dll
Size

10KB
MD5

39c1cbd78cd251c3e0518ca99ff599f0
SHA1

db08c58a737e52ffada393d354eaa6ff51d6a0a9
SHA256

66b7669750ea11f7f97c623915c45d6f18a6a1d6e0fe5c5bb4b34a4348939ac5
SHA512

bc43056b71908c3143c12d90e541d1b7d2777eb3bfaac3100e49891ea78c454cec946daf8a60734e339747d479171006b560d48447bdbbd8cc83fc950a12e851
SSDEEP

192:GEt2sMb0X4UIGQencM8NtNvEwUsu7fqBJyzT/6NW3WLSjW:GEMs2fUIGQencM8tj2rGJy/VR

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1028-0-0x0000000010000000-0x0000000010010000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2964	1028	WerFault.exe	50

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1028	1948	rundll32.exe	50
PID 1948 wrote to memory of 1028	1948	rundll32.exe	50
PID 1948 wrote to memory of 1028	1948	rundll32.exe	50

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\39c1cbd78cd251c3e0518ca99ff599f0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\39c1cbd78cd251c3e0518ca99ff599f0.dll,#1
  2⤵
  PID:1028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 596
    3⤵
    - Program crash
    PID:2964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1028 -ip 1028
1⤵
PID:1792

memory/1028-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download