45f7ff226b38766475fcc23fc9d96061c05dafe8834ebdd6d8493d17bac2bdcd

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 09:45

Target

c58e6a2c7a6e569cda51aad2efd64511.dll
Size

17KB
MD5

c58e6a2c7a6e569cda51aad2efd64511
SHA1

e0ec7ef4f29591838f507190b724c3a09bdc30f7
SHA256

45f7ff226b38766475fcc23fc9d96061c05dafe8834ebdd6d8493d17bac2bdcd
SHA512

022192f605b8f83991eb18d0b5f845036cf3f54e1f51809b8f99cae2623057feae74633314fbd7a2d29ce0beebe4d52ad57dc547792ab8162447725a602ae25d
SSDEEP

384:SLm1EKZOw/XDfm8KPJLE1w8NWx3TCXLtkUa5M5BQCn:euI+rjKPJE5s32XLtPqM53

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2860-1-0x0000000010000000-0x0000000010010000-memory.dmp	upx
behavioral2/memory/2860-2-0x0000000010000000-0x0000000010010000-memory.dmp	upx
behavioral2/memory/2860-3-0x0000000010000000-0x0000000010010000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3456	2860	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2860	rundll32.exe
2860	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 2860	1452	rundll32.exe	83
PID 1452 wrote to memory of 2860	1452	rundll32.exe	83
PID 1452 wrote to memory of 2860	1452	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c58e6a2c7a6e569cda51aad2efd64511.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c58e6a2c7a6e569cda51aad2efd64511.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 576
    3⤵
    - Program crash
    PID:3456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2860 -ip 2860
1⤵
PID:4408

memory/2860-1-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2860-2-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2860-3-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download