b1d1891bb3213a58f7334531b191d35fc446c72a34809fca8887e8ee610005cd

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05-02-2024 06:59

Target

91561f1a19a2775801740fe036ba63d1.dll
Size

178KB
MD5

91561f1a19a2775801740fe036ba63d1
SHA1

7e5e365d572893741c61f542cfbcd93ab83aebed
SHA256

b1d1891bb3213a58f7334531b191d35fc446c72a34809fca8887e8ee610005cd
SHA512

055fbc92e33d2a9269a8d1e6f193911f21574de208e1dc52bcf56398e1abdac4ce3cb64d5f9a1c70a1bb7bd1994dbbecc1a9440c22751317eebe3e6a06cc2539
SSDEEP

3072:IKNFpxUSZ1ABlbo1uA+4zDbNehZ8AnJWRtbzhQ1jA25lyXdD9+E455FTKg61xouB:FNFYSZ1wRoVzDbIbVnkRp9Q1LS/UTg1L

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/3528-0-0x0000000002290000-0x00000000022E1000-memory.dmp	upx
behavioral2/memory/3528-1-0x0000000002290000-0x00000000022E1000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4120 3528 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4120	3528	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1172 wrote to memory of 3528	1172	rundll32.exe	rundll32.exe
PID 1172 wrote to memory of 3528	1172	rundll32.exe	rundll32.exe
PID 1172 wrote to memory of 3528	1172	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\91561f1a19a2775801740fe036ba63d1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1172

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\91561f1a19a2775801740fe036ba63d1.dll,#1
2⤵
PID:3528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 556
3⤵
- Program crash
PID:4120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3528 -ip 3528
1⤵
PID:4152

memory/3528-0-0x0000000002290000-0x00000000022E1000-memory.dmp

Filesize
324KB

Download
memory/3528-1-0x0000000002290000-0x00000000022E1000-memory.dmp

Filesize
324KB

Download
memory/3528-2-0x00000000005B0000-0x00000000005C5000-memory.dmp

Filesize
84KB

Download
memory/3528-3-0x0000000002290000-0x00000000022E1000-memory.dmp

Filesize
324KB

Download