7b76d2c98dbf8c60cc47477d4fd610dbf7fc991d0b72df18b401622132e24b9a

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 01:13

Target

5492748ca440d8925ca1c6520e50400757ab1631e51f5936a008cffcb8ddfec9.dll
Size

1021KB
MD5

25a7e269e18b500603f15ac89b898242
SHA1

22b6c8f5b4c161d8c164c94674417f5bcf889b33
SHA256

5492748ca440d8925ca1c6520e50400757ab1631e51f5936a008cffcb8ddfec9
SHA512

47ceb86f6d7118c98a2cf2335beeeba6e67cd9d8fe275fd571139a45ba74481ed263f6274cd088cc47a5f8a8df91381b9fd4270626eb6cdaae67b02dbfa7dce4
SSDEEP

12288:+R5nWFpPoSxFEG3wu90CeW6YxzbdCfX1CviRC3w8Q0u1w0sVA8vJvP/OPA:VbvOG31eWRxzGX4KC3w8QBq0sdvEY

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/3028-0-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3028-1-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3028-2-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3028-3-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2036	3028	WerFault.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3028	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 3028	1652	rundll32.exe	28
PID 1652 wrote to memory of 3028	1652	rundll32.exe	28
PID 1652 wrote to memory of 3028	1652	rundll32.exe	28
PID 1652 wrote to memory of 3028	1652	rundll32.exe	28
PID 1652 wrote to memory of 3028	1652	rundll32.exe	28
PID 1652 wrote to memory of 3028	1652	rundll32.exe	28
PID 1652 wrote to memory of 3028	1652	rundll32.exe	28
PID 3028 wrote to memory of 2036	3028	rundll32.exe	29
PID 3028 wrote to memory of 2036	3028	rundll32.exe	29
PID 3028 wrote to memory of 2036	3028	rundll32.exe	29
PID 3028 wrote to memory of 2036	3028	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5492748ca440d8925ca1c6520e50400757ab1631e51f5936a008cffcb8ddfec9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5492748ca440d8925ca1c6520e50400757ab1631e51f5936a008cffcb8ddfec9.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 248
    3⤵
    - Program crash
    PID:2036

memory/3028-0-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3028-1-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3028-2-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3028-3-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download