e89165a67b17f1dbb694846d998fb19383fb1f3b9530325eebf00c91f20751dd

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-03-2024 15:51

Target

b7c8d342643d68ff3a243c1678c7dcb0.dll
Size

206KB
MD5

b7c8d342643d68ff3a243c1678c7dcb0
SHA1

49d8d16ffe8c257910e148c6e53a83b4e256cccd
SHA256

e89165a67b17f1dbb694846d998fb19383fb1f3b9530325eebf00c91f20751dd
SHA512

c6a48a95eb4b22b5a060473dee89ae96da35391607d7bc33d985b7a8780958213131525837c622af929d80a9fc4b762f91ccd23dce358aa8eac0c1e0d25dec55
SSDEEP

3072:qUTuDZCMaKhfS/Z87OiTqZMHGePv1IuQ6zvVkwz38vGUufMxHlbH+G9kj4:rT+jhfW5jZwZqrYCuEHlH+Gm

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/1104-0-0x00000000021F0000-0x0000000002240000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1584 1104 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1584	1104	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 368 wrote to memory of 1104	368	rundll32.exe	rundll32.exe
PID 368 wrote to memory of 1104	368	rundll32.exe	rundll32.exe
PID 368 wrote to memory of 1104	368	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7c8d342643d68ff3a243c1678c7dcb0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:368

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7c8d342643d68ff3a243c1678c7dcb0.dll,#1
2⤵
PID:1104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 568
3⤵
- Program crash
PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1104 -ip 1104
1⤵
PID:2688

memory/1104-0-0x00000000021F0000-0x0000000002240000-memory.dmp

Filesize
320KB

Download
memory/1104-1-0x0000000000920000-0x0000000000934000-memory.dmp

Filesize
80KB

Download
memory/1104-2-0x00000000021F0000-0x0000000002240000-memory.dmp

Filesize
320KB

Download