09d7919938cf859d2de117f934b0903822e76743bc707311d1d74724b7b32518

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 02:53

Target

2a2e1343b36220e91af7737f576c2204957577bd61694f7fde538a97da9d4994.dll
Size

682KB
MD5

59023493f937128b446ea065b69dcf4c
SHA1

b3f17b4041f1b057327b1f2ff7a91d719aa773a5
SHA256

2a2e1343b36220e91af7737f576c2204957577bd61694f7fde538a97da9d4994
SHA512

ce5595dacbaed819bb4226e1fd4b2e3fecf8178a37d3298432db319fb3ad6d0e54b72e1b5ba2743d71540f6d43b3380ac11ec6d7811622449dc8e03ee04def43
SSDEEP

6144:+RR5rhZFQGrsUwF7vlPoSjzC4AGybgG8Neydenpid:+R5nWFpPoSjm7Nbg3I

Score

7^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2456-0-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2456-2-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2456-3-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2456-4-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2456-1-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2812	2456	WerFault.exe	14

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2456	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2456	2548	rundll32.exe	14
PID 2548 wrote to memory of 2456	2548	rundll32.exe	14
PID 2548 wrote to memory of 2456	2548	rundll32.exe	14
PID 2548 wrote to memory of 2456	2548	rundll32.exe	14
PID 2548 wrote to memory of 2456	2548	rundll32.exe	14
PID 2548 wrote to memory of 2456	2548	rundll32.exe	14
PID 2548 wrote to memory of 2456	2548	rundll32.exe	14
PID 2456 wrote to memory of 2812	2456	rundll32.exe	29
PID 2456 wrote to memory of 2812	2456	rundll32.exe	29
PID 2456 wrote to memory of 2812	2456	rundll32.exe	29
PID 2456 wrote to memory of 2812	2456	rundll32.exe	29

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a2e1343b36220e91af7737f576c2204957577bd61694f7fde538a97da9d4994.dll,#1
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 252
  2⤵
  - Program crash
  PID:2812

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a2e1343b36220e91af7737f576c2204957577bd61694f7fde538a97da9d4994.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548

memory/2456-0-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2456-2-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2456-3-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2456-4-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2456-1-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download