92ac5bb64c36cbe636def0750621d2bca763a4c8a2277f7ff6790d65606bc0b5

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 16:38

Target

74fc85c9233a87cfe65576da86b1cae7.dll
Size

24KB
MD5

74fc85c9233a87cfe65576da86b1cae7
SHA1

4f99291abe05aba0ed0cbc4844bb1976034dd742
SHA256

92ac5bb64c36cbe636def0750621d2bca763a4c8a2277f7ff6790d65606bc0b5
SHA512

df3447481a4846ff757ad1be5f5adcf73699e6a8d85fac8217f8bab304ff0671343d771434e83b52a852efbdefeedd2c5d2b9f391da45e85940d1c2f238666ac
SSDEEP

768:+RBmjBN847AYRu15zkrSvSp6PL/m1vxYU+:0gjT7AYRu1OrSvSp6PLODY

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1948-3-0x00000000000F0000-0x0000000000103000-memory.dmp	upx
behavioral1/memory/1948-4-0x00000000000F0000-0x0000000000103000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\mseditcpl.exe rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2856 1948 WerFault.exe rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\mseditcpl.exe	rundll32.exe

pid	pid_target	process	target process
2856	1948	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1704 wrote to memory of 1948	1704	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 1948	1704	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 1948	1704	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 1948	1704	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 1948	1704	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 1948	1704	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 1948	1704	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 2856	1948	rundll32.exe	WerFault.exe
PID 1948 wrote to memory of 2856	1948	rundll32.exe	WerFault.exe
PID 1948 wrote to memory of 2856	1948	rundll32.exe	WerFault.exe
PID 1948 wrote to memory of 2856	1948	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74fc85c9233a87cfe65576da86b1cae7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 248
3⤵
- Program crash
PID:2856

memory/1948-1-0x00000000000E0000-0x00000000000F3000-memory.dmp

Filesize
76KB

Download
memory/1948-2-0x00000000000E0000-0x00000000000F3000-memory.dmp

Filesize
76KB

Download
memory/1948-0-0x00000000000E0000-0x00000000000F3000-memory.dmp

Filesize
76KB

Download
memory/1948-3-0x00000000000F0000-0x0000000000103000-memory.dmp

Filesize
76KB

Download
memory/1948-4-0x00000000000F0000-0x0000000000103000-memory.dmp

Filesize
76KB

Download
memory/1948-6-0x00000000000E0000-0x00000000000F3000-memory.dmp

Filesize
76KB

Download
memory/1948-7-0x00000000000E0000-0x00000000000F3000-memory.dmp

Filesize
76KB

Download
memory/1948-8-0x00000000000E0000-0x00000000000F3000-memory.dmp

Filesize
76KB

Download