5fae2ead7efe25e98093d6a384f56be386f308913f1e459c5a1c859c6eccd9e0

Analysis

max time kernel
93s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 15:50

Target

978818e55359d5433c5fd92acde75296.dll
Size

59KB
MD5

978818e55359d5433c5fd92acde75296
SHA1

920d968b33ee261d2a6dcb326d18d08fe58288d8
SHA256

5fae2ead7efe25e98093d6a384f56be386f308913f1e459c5a1c859c6eccd9e0
SHA512

9c61b336fc50fc67aff4a4ea10e05aab5587b37eeb723deb35e4caa6e864f90d6678076ff9ce54b9bf97e497a1b160c12a0f03e87388436382e271b0e1f86522
SSDEEP

1536:yFvzyAzZmvYAFlHYaApt2jMj311lP9/n4jYjMHuC5QMO1WMnouy8:svzZ6lapt2gj3NRn4jQdC5s1Lout

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2516-0-0x0000000010000000-0x0000000010019000-memory.dmp	upx
behavioral2/memory/2516-1-0x0000000010000000-0x0000000010019000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4624	2516	WerFault.exe	76

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 2516	4988	rundll32.exe	76
PID 4988 wrote to memory of 2516	4988	rundll32.exe	76
PID 4988 wrote to memory of 2516	4988	rundll32.exe	76

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\978818e55359d5433c5fd92acde75296.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\978818e55359d5433c5fd92acde75296.dll,#1
  2⤵
  PID:2516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 544
    3⤵
    - Program crash
    PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2516 -ip 2516
1⤵
PID:400

memory/2516-0-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2516-1-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download