d2015d65faf8366a204eb62b38bdf287abe768412c88e85fc30793f9bd14b371

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 09:31

Target

96d5570163482bcf43bccb692f608ed7.dll
Size

46KB
MD5

96d5570163482bcf43bccb692f608ed7
SHA1

258ba09c245df06ae03108f87b92ea27a6af14e7
SHA256

d2015d65faf8366a204eb62b38bdf287abe768412c88e85fc30793f9bd14b371
SHA512

63036465b1af15366cfb47172a7c636ee39178a5e7e75b7cc2a8d64df04683d68beca2bc4d88d1f0a770cd6c09659ba61294119aca682b7f7c201c6acf7fa555
SSDEEP

768:hpLX9VgdvVj5eteLQgec9XJWlvTukulFNAbbfzY4q3Ny3kFBKv0Mvv:hN9UZxtVJMT7uT2bbLh13kFBK

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/392-0-0x0000000010000000-0x000000001001C000-memory.dmp	upx
behavioral2/memory/392-2-0x0000000010000000-0x000000001001C000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3980	392	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 392	228	rundll32.exe	84
PID 228 wrote to memory of 392	228	rundll32.exe	84
PID 228 wrote to memory of 392	228	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\96d5570163482bcf43bccb692f608ed7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\96d5570163482bcf43bccb692f608ed7.dll,#1
  2⤵
  PID:392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 392 -s 588
    3⤵
    - Program crash
    PID:3980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 392 -ip 392
1⤵
PID:2560

memory/392-0-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/392-1-0x0000000000700000-0x0000000000706000-memory.dmp

Filesize
24KB

Download
memory/392-2-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/392-3-0x0000000000700000-0x0000000000706000-memory.dmp

Filesize
24KB

Download