964bf823d0bfa6b957c79f0e41d6efac27104e9aa9f5756d5ae69167491c7f7e

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21-04-2024 21:14

Target

964bf823d0bfa6b957c79f0e41d6efac27104e9aa9f5756d5ae69167491c7f7e.dll
Size

43KB
MD5

785fc2866b436a9ad6d395d4e9f161ec
SHA1

4b0b2af492c175dcaafa966711a6eef1899b9b9e
SHA256

964bf823d0bfa6b957c79f0e41d6efac27104e9aa9f5756d5ae69167491c7f7e
SHA512

ddba96573a5673f2b09c7c4caf3ad7654709a5111a2ab86d84aca1379c2585542be1ff4485af9d7376df4f7a9fee42e539ecad8c35f745b34a7c69f2789a654f
SSDEEP

768:lfeHhntWfnMkoCAYFEAcTj/MNsxS7iv6/Fw9TLv7AnbcuyD7UA:teHhsfnMkdV6/Mh7ii/FqLknouy8A

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4768-0-0x00000000756B0000-0x00000000756CE000-memory.dmp	upx
behavioral2/memory/4768-1-0x00000000756B0000-0x00000000756CE000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3244	4768	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 4768	4956	rundll32.exe	84
PID 4956 wrote to memory of 4768	4956	rundll32.exe	84
PID 4956 wrote to memory of 4768	4956	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\964bf823d0bfa6b957c79f0e41d6efac27104e9aa9f5756d5ae69167491c7f7e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\964bf823d0bfa6b957c79f0e41d6efac27104e9aa9f5756d5ae69167491c7f7e.dll,#1
  2⤵
  PID:4768
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 600
    3⤵
    - Program crash
    PID:3244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4768 -ip 4768
1⤵
PID:592

memory/4768-0-0x00000000756B0000-0x00000000756CE000-memory.dmp

Filesize
120KB

Download
memory/4768-1-0x00000000756B0000-0x00000000756CE000-memory.dmp

Filesize
120KB

Download