87c03390ce157e343dc7dee779adaf55755beae6605668bef9156191afea9737

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
12-05-2024 16:43

Target

$TEMP/SDM143/ExentCtlInstaller.dll
Size

94KB
MD5

b7ad06c57419ed74fff4872b8693c353
SHA1

753e6a6f55503ff14f243e07c80915df445d8efa
SHA256

fa4601e6048ca661536882e91e9756526de719c5db298f5481f892c121200a66
SHA512

838c9211fef9de1706409b8304ed43236d4b3dbfa551c56d51f15c4c31e18a2a7f64722ef4c6c291768ecf7ca40d9ae1ec08f3afab4979323a66caeb3452aa8f
SSDEEP

1536:JyrB9NViYoJ3w1NjSzF5yfBsiZpsVI2TFQblrjgZYBmmlNL9bnouy8/:o9eS3sF5EsuyQgp2out/

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral9/memory/2092-0-0x0000000010000000-0x0000000010063000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2112	2092	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2092	1960	rundll32.exe	28
PID 1960 wrote to memory of 2092	1960	rundll32.exe	28
PID 1960 wrote to memory of 2092	1960	rundll32.exe	28
PID 1960 wrote to memory of 2092	1960	rundll32.exe	28
PID 1960 wrote to memory of 2092	1960	rundll32.exe	28
PID 1960 wrote to memory of 2092	1960	rundll32.exe	28
PID 1960 wrote to memory of 2092	1960	rundll32.exe	28
PID 2092 wrote to memory of 2112	2092	rundll32.exe	29
PID 2092 wrote to memory of 2112	2092	rundll32.exe	29
PID 2092 wrote to memory of 2112	2092	rundll32.exe	29
PID 2092 wrote to memory of 2112	2092	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\ExentCtlInstaller.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\ExentCtlInstaller.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 232
    3⤵
    - Program crash
    PID:2112

memory/2092-0-0x0000000010000000-0x0000000010063000-memory.dmp

Filesize
396KB

Download