a7059049eaff7f0e4dd059a27c321d5019e7d7e7a3ec197c8983dae2dd1ed92a

Analysis

max time kernel
89s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 13:55

Target

7a6d2a894e765ef3f537b25c14543cec.dll
Size

93KB
MD5

7a6d2a894e765ef3f537b25c14543cec
SHA1

f3f92514466a97dc61d7e266a5212597d8817221
SHA256

a7059049eaff7f0e4dd059a27c321d5019e7d7e7a3ec197c8983dae2dd1ed92a
SHA512

ff44bf3aaf0af71e13ec648477ee82abca86fdb3f27d5fb3adce5a09d27a51bd3da027e89b7e6f032bc5b793da19089adbbc3538bc47420b61a02d10ad0f194c
SSDEEP

1536:lqoSNlFKn9F+e0A/7DUwgRZ+/HKd/xBWWWdw6pLUec1cl0Ds8B5s5wg4m4VzbE7R:lj0K9F+ezDUwgR4/qdvWbwkLUec1+A9g

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1376-0-0x0000000010000000-0x0000000010031000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
316	1376	WerFault.exe	18

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 1376	4176	rundll32.exe	18
PID 4176 wrote to memory of 1376	4176	rundll32.exe	18
PID 4176 wrote to memory of 1376	4176	rundll32.exe	18

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a6d2a894e765ef3f537b25c14543cec.dll,#1
1⤵
PID:1376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 544
  2⤵
  - Program crash
  PID:316

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a6d2a894e765ef3f537b25c14543cec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1376 -ip 1376
1⤵
PID:1900

memory/1376-0-0x0000000010000000-0x0000000010031000-memory.dmp

Filesize
196KB

Download