9e04a881bc821b139a993e005d41484341542a271d172c924c42a2a086580d1a

Analysis

max time kernel
90s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 05:53

Target

40167c3ef4b1afd2b897d89fdf612d1041c7e9e24169e5f32ebc0b00c7860c2b.dll
Size

449KB
MD5

f8e17ef618392dace3fc6b772c18e1e5
SHA1

ec97dbe18f4bd510636e6315095ec1439c3e92f4
SHA256

9e04a881bc821b139a993e005d41484341542a271d172c924c42a2a086580d1a
SHA512

c415c9c68485c707e0d468cbb542a3f6b03396c2e8efe2174fae42cd3586681e214dddd58093126f67dd5dfea66e328bbdfb85d2261ab93c857743fce3320a4c
SSDEEP

6144:/qMmee6ICfPQAX5/6HVtDA6ZZ61S5CkxL3XzsEiadXbg5GtvAgvU:iMSbCfIHkUs1SFxLnzsEi0Xrxu

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4612-1-0x0000000010000000-0x0000000010038000-memory.dmp	upx
behavioral2/memory/4612-0-0x0000000010000000-0x0000000010038000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3600	4612	WerFault.exe	86

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4612	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 4612	4772	rundll32.exe	86
PID 4772 wrote to memory of 4612	4772	rundll32.exe	86
PID 4772 wrote to memory of 4612	4772	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40167c3ef4b1afd2b897d89fdf612d1041c7e9e24169e5f32ebc0b00c7860c2b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\40167c3ef4b1afd2b897d89fdf612d1041c7e9e24169e5f32ebc0b00c7860c2b.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 600
    3⤵
    - Program crash
    PID:3600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4612 -ip 4612
1⤵
PID:1212

memory/4612-1-0x0000000010000000-0x0000000010038000-memory.dmp

Filesize
224KB

Download
memory/4612-0-0x0000000010000000-0x0000000010038000-memory.dmp

Filesize
224KB

Download