43fd35874b8b2c12576f78d246c296901c2d63f3cc161646085669561b6c3bc1

Analysis

max time kernel
138s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09-01-2024 05:19

Target

4d71059d98aa59631c7c11432a033f09.dll
Size

28KB
MD5

4d71059d98aa59631c7c11432a033f09
SHA1

f825dc4ee81f5548ab8f1b89912a45e9e7b2149f
SHA256

43fd35874b8b2c12576f78d246c296901c2d63f3cc161646085669561b6c3bc1
SHA512

d3b300d1e4be6a2a9486ff1d919fe371376d268b304a4e1cd7270025cef850ee8e392f3ca64cc9953f9601830cc575705e3abf7f8af2c033c582a186bc9e1fa4
SSDEEP

384:Pev8YAW72jYj1VRpbA5O66K7azEs4W5HnTHQpYsT/YaXnULNFMuhhcngMe:Pe2jyRJA5iK7azEJoHcYfaXn0NFM+cpe

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4908-0-0x0000000010000000-0x0000000010026000-memory.dmp	upx
behavioral2/memory/4908-2-0x0000000010000000-0x0000000010026000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2824	4908	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 4908	4196	rundll32.exe	90
PID 4196 wrote to memory of 4908	4196	rundll32.exe	90
PID 4196 wrote to memory of 4908	4196	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d71059d98aa59631c7c11432a033f09.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d71059d98aa59631c7c11432a033f09.dll,#1
  2⤵
  PID:4908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 544
    3⤵
    - Program crash
    PID:2824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4908 -ip 4908
1⤵
PID:3592

memory/4908-0-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download
memory/4908-1-0x0000000000EF0000-0x0000000000EF2000-memory.dmp

Filesize
8KB

Download
memory/4908-2-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download