05c1a06ae5d97821d6d495f478965b45326bfd869502258b4cc123d78d54e7f9

Analysis

max time kernel
66s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 20:05

Target

$PLUGINSDIR/extra.dll
Size

177KB
MD5

ddc0cd4c52586a7d90e498a660f4c771
SHA1

493f0f3d65018a7e659bef143665f495ad9251ed
SHA256

2df15d16e5b37de207c58f86770e82b1bbc21788c9560f34450acb48a9c5c208
SHA512

3e2f8cce4a9469cd94472ffa96217d6279cea2326c738460aa5d111b9b1036a728cccd47fab561d564b26a8187f4fd527cc1d16070eb6f9fb0e296cd4b3a24cf
SSDEEP

3072:QKCMUxVNXkQV3FRcA+sUJ6zWSdf67R1a+A3iLABEuHvaOjNdO44vsxBGkI/1:rC//iQV3PcA/9KSE73aViLIEUaOjNdOp

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral4/memory/4436-0-0x0000000074E90000-0x0000000074EF9000-memory.dmp	upx
behavioral4/memory/4436-1-0x0000000074E90000-0x0000000074EF9000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3340	4436	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 4436	4312	rundll32.exe	83
PID 4312 wrote to memory of 4436	4312	rundll32.exe	83
PID 4312 wrote to memory of 4436	4312	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\extra.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\extra.dll,#1
  2⤵
  PID:4436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 640
    3⤵
    - Program crash
    PID:3340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4436 -ip 4436
1⤵
PID:2944

memory/4436-0-0x0000000074E90000-0x0000000074EF9000-memory.dmp

Filesize
420KB

Download
memory/4436-1-0x0000000074E90000-0x0000000074EF9000-memory.dmp

Filesize
420KB

Download