7b76d2c98dbf8c60cc47477d4fd610dbf7fc991d0b72df18b401622132e24b9a

Analysis

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05/01/2024, 01:13

Target

5492748ca440d8925ca1c6520e50400757ab1631e51f5936a008cffcb8ddfec9.dll
Size

1021KB
MD5

25a7e269e18b500603f15ac89b898242
SHA1

22b6c8f5b4c161d8c164c94674417f5bcf889b33
SHA256

5492748ca440d8925ca1c6520e50400757ab1631e51f5936a008cffcb8ddfec9
SHA512

47ceb86f6d7118c98a2cf2335beeeba6e67cd9d8fe275fd571139a45ba74481ed263f6274cd088cc47a5f8a8df91381b9fd4270626eb6cdaae67b02dbfa7dce4
SSDEEP

12288:+R5nWFpPoSxFEG3wu90CeW6YxzbdCfX1CviRC3w8Q0u1w0sVA8vJvP/OPA:VbvOG31eWRxzGX4KC3w8QBq0sdvEY

Score

7^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1436-0-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1436-1-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1436-2-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1436-3-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1436-4-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1792	1436	WerFault.exe	88

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1436	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 1436	4464	rundll32.exe	88
PID 4464 wrote to memory of 1436	4464	rundll32.exe	88
PID 4464 wrote to memory of 1436	4464	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5492748ca440d8925ca1c6520e50400757ab1631e51f5936a008cffcb8ddfec9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5492748ca440d8925ca1c6520e50400757ab1631e51f5936a008cffcb8ddfec9.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 644
    3⤵
    - Program crash
    PID:1792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1436 -ip 1436
1⤵
PID:4208

memory/1436-0-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1436-1-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1436-2-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1436-3-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1436-4-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download