cef3d50c2e66bdf8ed1d7921da5d1e63d2f4e2ece7ce79a3e9e679152a0f299f

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-02-2024 23:01

Target

a7926fc5641df3537a67bd59843666b1.dll
Size

196KB
MD5

a7926fc5641df3537a67bd59843666b1
SHA1

49f4eef600cef928c7e9eda754d57feba8bd91d0
SHA256

cef3d50c2e66bdf8ed1d7921da5d1e63d2f4e2ece7ce79a3e9e679152a0f299f
SHA512

3ef9cdd589c7c25432a6ad6aedc3fe8ecc11a39b6bff3899cc8b156cc5e32a5f8d80070e9015a8d44840ff86978f6a5eb93aaba7a43bf58d0ce584796bac58fe
SSDEEP

6144:CWsewnqFtjqnFt390R0+Dn2psxjdFctUr8D47ZoS:CWQn4tjC3edDn22xdF2pD47ZoS

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/3316-0-0x0000000000400000-0x0000000000460000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4664 3316 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4664	3316	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3868 wrote to memory of 3316	3868	rundll32.exe	rundll32.exe
PID 3868 wrote to memory of 3316	3868	rundll32.exe	rundll32.exe
PID 3868 wrote to memory of 3316	3868	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a7926fc5641df3537a67bd59843666b1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3868

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a7926fc5641df3537a67bd59843666b1.dll,#1
2⤵
PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 548
3⤵
- Program crash
PID:4664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3316 -ip 3316
1⤵
PID:4652

memory/3316-0-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3316-1-0x0000000000D00000-0x0000000000D14000-memory.dmp

Filesize
80KB

Download