e96c7628029915b660036bc40e41a38bbba7ea445c485274ab87c88016158a3f

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 04:14

Target
4a691b69c11387b2c2e19e50c27e3c80.dll
Size 66KB
Sample240108-etpljaahck
SHA256 e96c7628029915b660036bc40e41a38bbba7ea445c485274ab87c88016158a3f
MD5 4a691b69c11387b2c2e19e50c27e3c80
SHA1 7ae3ae8390af4c2c39cf14cd26699e24b04ce4ec
SHA512 f33d85d15081910f063d8667870a1812d2e9b877a3a96ddb7471fdf33049d83b0bc12bfc1a7449514c922c74e5c6c14b686d6d2148ef13342ba78ea626c84248
SSDEEP 1536:GyLua1K0xP0DBCfdq6Zx/HRNVLRpedZk7hQB5ZmUOMt+eE:GscxifRbRwxOMt+p
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3948-0-0x0000000010000000-0x0000000010042000-memory.dmp	upx
behavioral2/memory/3948-1-0x0000000010000000-0x0000000010042000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4844	3948	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 3948	2820	rundll32.exe	87
PID 2820 wrote to memory of 3948	2820	rundll32.exe	87
PID 2820 wrote to memory of 3948	2820	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a691b69c11387b2c2e19e50c27e3c80.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a691b69c11387b2c2e19e50c27e3c80.dll,#1
  2⤵
  PID:3948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 692
    3⤵
    - Program crash
    PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3948 -ip 3948
1⤵
PID:4264

memory/3948-0-0x0000000010000000-0x0000000010042000-memory.dmp

Download

memory/3948-1-0x0000000010000000-0x0000000010042000-memory.dmp

Download