a2aab057aa5a0c0d2ce7caf07c61ae76e99c1f6046ef336185b96b44609394b8

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 15:07

Target

53d86e42eaaa473870221ba2b998fb89.dll
Size

13KB
MD5

53d86e42eaaa473870221ba2b998fb89
SHA1

79c685a72e9d710969b36f54c863944fd7bb51c2
SHA256

a2aab057aa5a0c0d2ce7caf07c61ae76e99c1f6046ef336185b96b44609394b8
SHA512

3259ec5d18f5e051f91cfedc8cc5eebed68767dc707b0e365f9c5c43b3cc8d038d15ee4be6cc14f0c384a697d3382a8457f834a82cdc468b18b8d3565b8b7bc9
SSDEEP

384:AITUVOKli7qX3kSHdJjvk1C7E3oD+aNJawcudoD7UD:eUYkSHnjk10E4DPnbcuyD7U

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1164-1-0x0000000010000000-0x000000001000A000-memory.dmp	upx
behavioral1/memory/1164-2-0x0000000010000000-0x000000001000A000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2948	1164	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 1164	3052	rundll32.exe	28
PID 3052 wrote to memory of 1164	3052	rundll32.exe	28
PID 3052 wrote to memory of 1164	3052	rundll32.exe	28
PID 3052 wrote to memory of 1164	3052	rundll32.exe	28
PID 3052 wrote to memory of 1164	3052	rundll32.exe	28
PID 3052 wrote to memory of 1164	3052	rundll32.exe	28
PID 3052 wrote to memory of 1164	3052	rundll32.exe	28
PID 1164 wrote to memory of 2948	1164	rundll32.exe	29
PID 1164 wrote to memory of 2948	1164	rundll32.exe	29
PID 1164 wrote to memory of 2948	1164	rundll32.exe	29
PID 1164 wrote to memory of 2948	1164	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\53d86e42eaaa473870221ba2b998fb89.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\53d86e42eaaa473870221ba2b998fb89.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 248
    3⤵
    - Program crash
    PID:2948

memory/1164-0-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/1164-1-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/1164-2-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download