5fbe22f977ff6a33746652cf5ca143c05eb242a1e20d56a662ef572f1e58cade

Analysis

max time kernel
137s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2024 06:40

Target

3c2658c042d05cbb82a38b07eb929901.dll
Size

176KB
MD5

3c2658c042d05cbb82a38b07eb929901
SHA1

e0cf3cb69d2a74f6bdac14d0ea16d24d87d7a499
SHA256

5fbe22f977ff6a33746652cf5ca143c05eb242a1e20d56a662ef572f1e58cade
SHA512

2390577006c398ccad12e09ed6b3a75d25d7ef7cab06283551ec1604f245884f2e8e0df475f652efd6a707b17613b4c16222436ea997fa09ffced6bc3c709acd
SSDEEP

3072:EfQ9DX7m6Cpp9FZTv6MPPrYZFLCD39dkLnfXZQjIkm9OdxUWLofLiHwhsjttoutl:Vj7i9LvhUFSn0Xsdm2sLkoS

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/3772-0-0x0000000000400000-0x0000000000451000-memory.dmp	upx
behavioral2/memory/3772-2-0x0000000000400000-0x0000000000451000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1520 3772 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1520	3772	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4832 wrote to memory of 3772	4832	rundll32.exe	rundll32.exe
PID 4832 wrote to memory of 3772	4832	rundll32.exe	rundll32.exe
PID 4832 wrote to memory of 3772	4832	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c2658c042d05cbb82a38b07eb929901.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4832

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c2658c042d05cbb82a38b07eb929901.dll,#1
2⤵
PID:3772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 544
3⤵
- Program crash
PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3772 -ip 3772
1⤵
PID:772

memory/3772-0-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/3772-1-0x00000000028A0000-0x00000000028B4000-memory.dmp

Filesize
80KB

Download
memory/3772-2-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download