2ff2ba5b37acf3f129832c9f1ceacc6c6148ed71726bc4e262d829ee80430192

Analysis

max time kernel
143s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 20:22

Target

$PLUGINSDIR/nsArray.dll
Size

6KB
MD5

82d49c227928741f6f09c5cea3bde9f1
SHA1

b0904368a5e94026d0ca5760d4577236f796051d
SHA256

8bc5e75bbfa5a8f10526aec2af441153b2883d6d288726ed8f7c9af12a1ee02b
SHA512

d4f588e3613886e3dab58330cd69ce7f24c39be2c4854cc8edfcef98e1324926fcde0d79df1a8fdf5e2bf9327b17f22a9fa1396568c0ace4e46d4f548fdc7530
SSDEEP

192:mUODeqedh6EHFRA5sX7d7KnnpOKxX22v:2qqedh6EHFRksp7KpFX

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral31/memory/2076-3-0x0000000074850000-0x000000007485A000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
848	2076	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 2076	1556	rundll32.exe	28
PID 1556 wrote to memory of 2076	1556	rundll32.exe	28
PID 1556 wrote to memory of 2076	1556	rundll32.exe	28
PID 1556 wrote to memory of 2076	1556	rundll32.exe	28
PID 1556 wrote to memory of 2076	1556	rundll32.exe	28
PID 1556 wrote to memory of 2076	1556	rundll32.exe	28
PID 1556 wrote to memory of 2076	1556	rundll32.exe	28
PID 2076 wrote to memory of 848	2076	rundll32.exe	29
PID 2076 wrote to memory of 848	2076	rundll32.exe	29
PID 2076 wrote to memory of 848	2076	rundll32.exe	29
PID 2076 wrote to memory of 848	2076	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsArray.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsArray.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 224
    3⤵
    - Program crash
    PID:848

memory/2076-0-0x0000000074860000-0x000000007486A000-memory.dmp

Filesize
40KB

Download
memory/2076-2-0x0000000074860000-0x000000007486A000-memory.dmp

Filesize
40KB

Download
memory/2076-3-0x0000000074850000-0x000000007485A000-memory.dmp

Filesize
40KB

Download
memory/2076-1-0x0000000074840000-0x000000007484A000-memory.dmp

Filesize
40KB

Download
memory/2076-6-0x0000000074860000-0x000000007486A000-memory.dmp

Filesize
40KB

Download
memory/2076-7-0x0000000074860000-0x000000007486A000-memory.dmp

Filesize
40KB

Download