a3a875372a18e1e91397e6c3e7f5e0ab3dba911c5908188eb9f4de48b40f0416

Analysis

max time kernel
139s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/03/2024, 17:05

Target

b2aa23d6b4adb8f8623cc51498ba5c5d.dll
Size

184KB
MD5

b2aa23d6b4adb8f8623cc51498ba5c5d
SHA1

93c9b95d401213f3d9197a3d8c6398da335b6c96
SHA256

a3a875372a18e1e91397e6c3e7f5e0ab3dba911c5908188eb9f4de48b40f0416
SHA512

630639faa98888d5cd268340a4219e199df2b7d95b9ce37f961ecfa62e6d080900f9680fec2bcb74f4652a686b173537e00b5089f144519c468e185274d911d9
SSDEEP

3072:QILqzszmqBPWnF3wTn/4zxHHA1qi9R2BtzwD6TCaBPQGHHfWB4ulpj4SqJOrcYHG:QLhqB4FgT/4zRg2rzqCFBPR/WBDj4OrF

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2108-0-0x0000000000400000-0x0000000000449000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1604	2108	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 2108	1468	rundll32.exe	90
PID 1468 wrote to memory of 2108	1468	rundll32.exe	90
PID 1468 wrote to memory of 2108	1468	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2aa23d6b4adb8f8623cc51498ba5c5d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2aa23d6b4adb8f8623cc51498ba5c5d.dll,#1
  2⤵
  PID:2108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 540
    3⤵
    - Program crash
    PID:1604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2108 -ip 2108
1⤵
PID:3880

memory/2108-0-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2108-1-0x0000000000BE0000-0x0000000000BF5000-memory.dmp

Filesize
84KB

Download