ddb62fe8611e6e37b8b37413dea5e5f813f441e1601f8c805787a2d94265a8cb

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 11:56

Target

office2019pjb_9435/office2019pjb/OTool/files/Thunder/xldl.dll
Size

106KB
MD5

b700bd2daf84e4dbbcad96221a772d6b
SHA1

b57cab2d8cfc733d6aacc61a39ce5564db0f7b3b
SHA256

63ae9dd4a504261591f06bd9457d07629155241df615bd46a0fb48e76c5e9d56
SHA512

d573e7b2863053e2b4d81a4a89dcbee83fc079403ab36c54e3e0904a3b5d61d1aff0b8bb32d164e496f8425bf8e40e803480c694506e6e156434b8350b736a10
SSDEEP

3072:/WcKtZ5jVYBrJfbUfCoIydGHoqXUWIoutMsvmd:/WPnfYBrJWIydGHotoSPC

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral23/memory/3048-0-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral23/memory/3048-1-0x0000000010000000-0x000000001004D000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2948	3048	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 3048	1952	rundll32.exe	28
PID 1952 wrote to memory of 3048	1952	rundll32.exe	28
PID 1952 wrote to memory of 3048	1952	rundll32.exe	28
PID 1952 wrote to memory of 3048	1952	rundll32.exe	28
PID 1952 wrote to memory of 3048	1952	rundll32.exe	28
PID 1952 wrote to memory of 3048	1952	rundll32.exe	28
PID 1952 wrote to memory of 3048	1952	rundll32.exe	28
PID 3048 wrote to memory of 2948	3048	rundll32.exe	29
PID 3048 wrote to memory of 2948	3048	rundll32.exe	29
PID 3048 wrote to memory of 2948	3048	rundll32.exe	29
PID 3048 wrote to memory of 2948	3048	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\office2019pjb_9435\office2019pjb\OTool\files\Thunder\xldl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\office2019pjb_9435\office2019pjb\OTool\files\Thunder\xldl.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 232
    3⤵
    - Program crash
    PID:2948

memory/3048-0-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/3048-1-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download