f9e41fe0854e1d2cba512b09924e117b044f23232e621b02e762a0988b044636

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 03:07

Target

$PLUGINSDIR/System.dll
Size

7KB
MD5

8b06f277ae47f0d2e1c7098a5657ee88
SHA1

e3802a6f3949b6c8cd058d840b8776ebf587eed2
SHA256

ddccebbf499672af3a74be6fb838b804a66679f7689dde137c39f4e0df1be11d
SHA512

6bb68bd7ce5577ba6460ba2eb11536703d0472ba6f91f2fd9b2ec93128cc2700a426217b1029380a8b98cb823b67959d73edd99b3c3812532530aeae0d928060
SSDEEP

192:Tdfh7NV2z5EBeRSUqc23Kh2mkkxZoPRACMh:vuVEBiqclUa7op8

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral7/memory/612-1-0x0000000074DF0000-0x0000000074DF9000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1728	612	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 612	2076	rundll32.exe	28
PID 2076 wrote to memory of 612	2076	rundll32.exe	28
PID 2076 wrote to memory of 612	2076	rundll32.exe	28
PID 2076 wrote to memory of 612	2076	rundll32.exe	28
PID 2076 wrote to memory of 612	2076	rundll32.exe	28
PID 2076 wrote to memory of 612	2076	rundll32.exe	28
PID 2076 wrote to memory of 612	2076	rundll32.exe	28
PID 612 wrote to memory of 1728	612	rundll32.exe	29
PID 612 wrote to memory of 1728	612	rundll32.exe	29
PID 612 wrote to memory of 1728	612	rundll32.exe	29
PID 612 wrote to memory of 1728	612	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 612 -s 224
    3⤵
    - Program crash
    PID:1728

memory/612-2-0x0000000074E00000-0x0000000074E09000-memory.dmp

Filesize
36KB

Download
memory/612-1-0x0000000074DF0000-0x0000000074DF9000-memory.dmp

Filesize
36KB

Download
memory/612-0-0x0000000074E00000-0x0000000074E09000-memory.dmp

Filesize
36KB

Download
memory/612-6-0x0000000074E00000-0x0000000074E09000-memory.dmp

Filesize
36KB

Download
memory/612-5-0x0000000074E00000-0x0000000074E09000-memory.dmp

Filesize
36KB

Download