7f1474fd97fa65afbb57e88c2c047fff400ac63c38a09929152b90d76e8b3728

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13-02-2024 04:42

Target

9880170d40bdb2febb6935fc02011315.dll
Size

84KB
MD5

9880170d40bdb2febb6935fc02011315
SHA1

598a7ca1f1d19f57b3f0c656a5462d60c73b7bb9
SHA256

7f1474fd97fa65afbb57e88c2c047fff400ac63c38a09929152b90d76e8b3728
SHA512

51920aa625812eebf53087189bf0869562be50f0d9f261064f850843c9e55c472d4468264671a65eca9dc0d01e2812ebf62b53148c654ed2c1175ae75aaf1b3a
SSDEEP

1536:xyXpW8Yxc4twuyTwBy76mEw/ttFrYX1jNksGk05cwzUPkyL8d:xyZLYm4WuyTv72w/jFrQ1Z+k05bzSTL0

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3916-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx
behavioral2/memory/3916-1-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3780	3916	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 3916	2900	rundll32.exe	84
PID 2900 wrote to memory of 3916	2900	rundll32.exe	84
PID 2900 wrote to memory of 3916	2900	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9880170d40bdb2febb6935fc02011315.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9880170d40bdb2febb6935fc02011315.dll,#1
  2⤵
  PID:3916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 560
    3⤵
    - Program crash
    PID:3780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3916 -ip 3916
1⤵
PID:2460

memory/3916-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/3916-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download