cfa31e32a3831bdce0b61daf94ec6d38b002a646fb1396e028f8f1cb38a535f0

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-03-2024 20:13

Target

b59053d4dc6cd729d40a84fb06ade49d.dll
Size

208KB
MD5

b59053d4dc6cd729d40a84fb06ade49d
SHA1

6e8b0088f0bf5de4b2365032c849f41e4e7e9600
SHA256

cfa31e32a3831bdce0b61daf94ec6d38b002a646fb1396e028f8f1cb38a535f0
SHA512

a2c0cffc07bc9a4047608f595b58334052dd34201ca8df01b16b677da0d89125a2fa18cfa978878e6c9ab4a676942dad9e57f986e08b724d655553381230af4f
SSDEEP

6144:Z6Ye2tnoL+hq7KfRFPnz1ZeAzjAr+k6/3bP2cgCNoSH:UYf9fn/z1PPOU6teoSH

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/3404-0-0x0000000002500000-0x0000000002567000-memory.dmp	upx
behavioral1/memory/3404-1-0x0000000002500000-0x0000000002567000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1924 3404 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1924	3404	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2900 wrote to memory of 3404	2900	rundll32.exe	rundll32.exe
PID 2900 wrote to memory of 3404	2900	rundll32.exe	rundll32.exe
PID 2900 wrote to memory of 3404	2900	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b59053d4dc6cd729d40a84fb06ade49d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2900

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b59053d4dc6cd729d40a84fb06ade49d.dll,#1
2⤵
PID:3404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 548
3⤵
- Program crash
PID:1924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3404 -ip 3404
1⤵
PID:2460

memory/3404-0-0x0000000002500000-0x0000000002567000-memory.dmp

Filesize
412KB

Download
memory/3404-1-0x0000000002500000-0x0000000002567000-memory.dmp

Filesize
412KB

Download
memory/3404-2-0x0000000002570000-0x0000000002584000-memory.dmp

Filesize
80KB

Download