05c1a06ae5d97821d6d495f478965b45326bfd869502258b4cc123d78d54e7f9

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 20:05

Target

$PLUGINSDIR/extra.dll
Size

177KB
MD5

ddc0cd4c52586a7d90e498a660f4c771
SHA1

493f0f3d65018a7e659bef143665f495ad9251ed
SHA256

2df15d16e5b37de207c58f86770e82b1bbc21788c9560f34450acb48a9c5c208
SHA512

3e2f8cce4a9469cd94472ffa96217d6279cea2326c738460aa5d111b9b1036a728cccd47fab561d564b26a8187f4fd527cc1d16070eb6f9fb0e296cd4b3a24cf
SSDEEP

3072:QKCMUxVNXkQV3FRcA+sUJ6zWSdf67R1a+A3iLABEuHvaOjNdO44vsxBGkI/1:rC//iQV3PcA/9KSE73aViLIEUaOjNdOp

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral3/memory/2660-1-0x0000000074EE0000-0x0000000074F49000-memory.dmp	upx
behavioral3/memory/2660-3-0x0000000074EE0000-0x0000000074F49000-memory.dmp	upx
behavioral3/memory/2660-4-0x0000000074EE0000-0x0000000074F49000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3056	2660	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2660	2460	rundll32.exe	28
PID 2460 wrote to memory of 2660	2460	rundll32.exe	28
PID 2460 wrote to memory of 2660	2460	rundll32.exe	28
PID 2460 wrote to memory of 2660	2460	rundll32.exe	28
PID 2460 wrote to memory of 2660	2460	rundll32.exe	28
PID 2460 wrote to memory of 2660	2460	rundll32.exe	28
PID 2460 wrote to memory of 2660	2460	rundll32.exe	28
PID 2660 wrote to memory of 3056	2660	rundll32.exe	29
PID 2660 wrote to memory of 3056	2660	rundll32.exe	29
PID 2660 wrote to memory of 3056	2660	rundll32.exe	29
PID 2660 wrote to memory of 3056	2660	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\extra.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\extra.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 252
    3⤵
    - Program crash
    PID:3056

memory/2660-0-0x0000000074F50000-0x0000000074FB9000-memory.dmp

Filesize
420KB

Download
memory/2660-1-0x0000000074EE0000-0x0000000074F49000-memory.dmp

Filesize
420KB

Download
memory/2660-3-0x0000000074EE0000-0x0000000074F49000-memory.dmp

Filesize
420KB

Download
memory/2660-2-0x0000000074F50000-0x0000000074FB9000-memory.dmp

Filesize
420KB

Download
memory/2660-4-0x0000000074EE0000-0x0000000074F49000-memory.dmp

Filesize
420KB

Download
memory/2660-6-0x0000000074F50000-0x0000000074FB9000-memory.dmp

Filesize
420KB

Download