14dcf16ecda93e0b750e97406d3f992210cc5c0ccc90a4b48c9ca46e38877d6b

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 08:44

Target

$PLUGINSDIR/extra.dll
Size

177KB
MD5

ddc0cd4c52586a7d90e498a660f4c771
SHA1

493f0f3d65018a7e659bef143665f495ad9251ed
SHA256

2df15d16e5b37de207c58f86770e82b1bbc21788c9560f34450acb48a9c5c208
SHA512

3e2f8cce4a9469cd94472ffa96217d6279cea2326c738460aa5d111b9b1036a728cccd47fab561d564b26a8187f4fd527cc1d16070eb6f9fb0e296cd4b3a24cf
SSDEEP

3072:QKCMUxVNXkQV3FRcA+sUJ6zWSdf67R1a+A3iLABEuHvaOjNdO44vsxBGkI/1:rC//iQV3PcA/9KSE73aViLIEUaOjNdOp

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral3/memory/3004-3-0x0000000074750000-0x00000000747B9000-memory.dmp	upx
behavioral3/memory/3004-1-0x0000000074750000-0x00000000747B9000-memory.dmp	upx
behavioral3/memory/3004-4-0x0000000074750000-0x00000000747B9000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3036	3004	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 3004	1148	rundll32.exe	28
PID 1148 wrote to memory of 3004	1148	rundll32.exe	28
PID 1148 wrote to memory of 3004	1148	rundll32.exe	28
PID 1148 wrote to memory of 3004	1148	rundll32.exe	28
PID 1148 wrote to memory of 3004	1148	rundll32.exe	28
PID 1148 wrote to memory of 3004	1148	rundll32.exe	28
PID 1148 wrote to memory of 3004	1148	rundll32.exe	28
PID 3004 wrote to memory of 3036	3004	rundll32.exe	29
PID 3004 wrote to memory of 3036	3004	rundll32.exe	29
PID 3004 wrote to memory of 3036	3004	rundll32.exe	29
PID 3004 wrote to memory of 3036	3004	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\extra.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\extra.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 252
    3⤵
    - Program crash
    PID:3036

memory/3004-0-0x0000000074740000-0x00000000747A9000-memory.dmp

Filesize
420KB

Download
memory/3004-3-0x0000000074750000-0x00000000747B9000-memory.dmp

Filesize
420KB

Download
memory/3004-2-0x0000000074740000-0x00000000747A9000-memory.dmp

Filesize
420KB

Download
memory/3004-1-0x0000000074750000-0x00000000747B9000-memory.dmp

Filesize
420KB

Download
memory/3004-4-0x0000000074750000-0x00000000747B9000-memory.dmp

Filesize
420KB

Download