7e008c4e55bbef387c3e0c8c79de1bb6fd165ab120759187772e8dfca4e1faf3

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 02:03

Target

b63d0b334de03e74eaefc13b8af213be.dll
Size

46KB
MD5

b63d0b334de03e74eaefc13b8af213be
SHA1

6bf1ccfaf99bd97a9e14abadee484bfe08e84ba5
SHA256

7e008c4e55bbef387c3e0c8c79de1bb6fd165ab120759187772e8dfca4e1faf3
SHA512

40bf3ed94a0ba25272a6f4f0c242c210f5cf263faa695cab65dc8dde3e362a8ff8a5ae16d70cab1d81fd886e805366fbe151b62dda4b30d670670bd10ae8c2e8
SSDEEP

768:/aPg5IHEg2b0hLSWI1Tnbl2+TLNXewCry/cnjRDzE+ltPWIU0+9JITgTGUnbcuyc:SPjHl2bk9I1fl2ye5ry/CEg/e7nouy8j

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3352-0-0x0000000010000000-0x0000000010019000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1796	3352	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 3352	4916	rundll32.exe	88
PID 4916 wrote to memory of 3352	4916	rundll32.exe	88
PID 4916 wrote to memory of 3352	4916	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b63d0b334de03e74eaefc13b8af213be.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b63d0b334de03e74eaefc13b8af213be.dll,#1
  2⤵
  PID:3352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 588
    3⤵
    - Program crash
    PID:1796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3352 -ip 3352
1⤵
PID:2340

memory/3352-0-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download