fcb9ce64dc0753a2659076769173de9459c1ac4761a60b001d37716dea2324fa

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2024 02:22

Target

e08a4506e52b15b2622e2460c69ee4b6.dll
Size

160KB
MD5

e08a4506e52b15b2622e2460c69ee4b6
SHA1

5aac8cc3a4444a84d9ca13ae9ef45a984d5021e3
SHA256

fcb9ce64dc0753a2659076769173de9459c1ac4761a60b001d37716dea2324fa
SHA512

89dc668b4068defc220d6a144fa955f5c65f01fb2adcf208c0557d4b48cb025fa18354da770e76bace1b522affa3787b2d72ed03318615781b9a6211345c34ba
SSDEEP

3072:3KSlmFjZTtbULRRmnAiHNbm6B8iUyqOw5nAPvuKQWJYbEbhZVmqRCByy4mo8outu:I3bMfiHNa6B8iUd5nAeTUyChTmq4BbWI

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1864-1-0x0000000000AD0000-0x0000000000B19000-memory.dmp	upx
behavioral2/memory/1864-0-0x0000000000AD0000-0x0000000000B19000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3932	1864	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 1864	4400	rundll32.exe	89
PID 4400 wrote to memory of 1864	4400	rundll32.exe	89
PID 4400 wrote to memory of 1864	4400	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e08a4506e52b15b2622e2460c69ee4b6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e08a4506e52b15b2622e2460c69ee4b6.dll,#1
  2⤵
  PID:1864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 544
    3⤵
    - Program crash
    PID:3932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1864 -ip 1864
1⤵
PID:2424

memory/1864-1-0x0000000000AD0000-0x0000000000B19000-memory.dmp

Filesize
292KB

Download
memory/1864-0-0x0000000000AD0000-0x0000000000B19000-memory.dmp

Filesize
292KB

Download
memory/1864-2-0x0000000000700000-0x0000000000714000-memory.dmp

Filesize
80KB

Download