bee48de6404ef2f0b5cbf79de793914f7f45dc01dc7a05fa13992829cf0c1933

Analysis

max time kernel
115s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 17:55

Target

ac7e871697b822f4d4d8c734407f7e55.dll
Size

32KB
MD5

ac7e871697b822f4d4d8c734407f7e55
SHA1

69badb6906ea7b2a6cef67269fdc3f7f1b0784ca
SHA256

bee48de6404ef2f0b5cbf79de793914f7f45dc01dc7a05fa13992829cf0c1933
SHA512

51fc34da9f96da4451bc2c5eb4330ae2b59deba2522af6036b9dd70eeffd921acf238f792db9241cacb3772d27778a2ff4d04f99d2abb934e3c51c4b3f54adc6
SSDEEP

768:+JN0bMXJhuJwjFLCw+vcK1ct4Q27P/+kRfkepJnYnbcuyD7UG:UNnXiJwRCtYH27P/n1bnYnouy8G

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1452-0-0x0000000010000000-0x0000000010015000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2160	1452	WerFault.exe	22

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 1452	1884	rundll32.exe	22
PID 1884 wrote to memory of 1452	1884	rundll32.exe	22
PID 1884 wrote to memory of 1452	1884	rundll32.exe	22

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac7e871697b822f4d4d8c734407f7e55.dll,#1
1⤵
PID:1452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 560
  2⤵
  - Program crash
  PID:2160

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac7e871697b822f4d4d8c734407f7e55.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1452 -ip 1452
1⤵
PID:1476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4100 --field-trial-handle=3044,i,17059189006398306756,4247826696353232857,262144 --variations-seed-version /prefetch:8
1⤵
PID:4968

memory/1452-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download