c00ccb8652171093889ac6d6391e8fa962980e53d6b863e0667f8001e8a9fa04

Analysis

max time kernel
149s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09-01-2024 10:44

Target

4e181a029753852087ccfcef6ec398bf.dll
Size

216KB
MD5

4e181a029753852087ccfcef6ec398bf
SHA1

99aa1c4adf27b4acf390fe0e09b6747905022cde
SHA256

c00ccb8652171093889ac6d6391e8fa962980e53d6b863e0667f8001e8a9fa04
SHA512

937b8275da10aacdbec2d2564740e7858feca66f829b178939d9e82bd602b7409066890cbe470d2cdafb727a9fae1f5b2a061f3f96648b34603f729c31950e46
SSDEEP

6144:qDOr7lSFcI4mmRTKkkiDHJYMcMk7Y6vVWWFYrAW1z8b+SzmnT:hPrmETnk6pYMw77oWqAqg8nT

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/2648-0-0x0000000000A60000-0x0000000000AB7000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2368 2648 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2368	2648	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4380 wrote to memory of 2648	4380	rundll32.exe	rundll32.exe
PID 4380 wrote to memory of 2648	4380	rundll32.exe	rundll32.exe
PID 4380 wrote to memory of 2648	4380	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e181a029753852087ccfcef6ec398bf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4380

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e181a029753852087ccfcef6ec398bf.dll,#1
2⤵
PID:2648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 568
3⤵
- Program crash
PID:2368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2648 -ip 2648
1⤵
PID:2084

memory/2648-0-0x0000000000A60000-0x0000000000AB7000-memory.dmp

Filesize
348KB

Download
memory/2648-1-0x00000000005D0000-0x00000000005E4000-memory.dmp

Filesize
80KB

Download