ddb62fe8611e6e37b8b37413dea5e5f813f441e1601f8c805787a2d94265a8cb

Analysis

max time kernel
125s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 11:56

Target

office2019pjb_9435/office2019pjb/OTool/files/Thunder/xldl.dll
Size

106KB
MD5

b700bd2daf84e4dbbcad96221a772d6b
SHA1

b57cab2d8cfc733d6aacc61a39ce5564db0f7b3b
SHA256

63ae9dd4a504261591f06bd9457d07629155241df615bd46a0fb48e76c5e9d56
SHA512

d573e7b2863053e2b4d81a4a89dcbee83fc079403ab36c54e3e0904a3b5d61d1aff0b8bb32d164e496f8425bf8e40e803480c694506e6e156434b8350b736a10
SSDEEP

3072:/WcKtZ5jVYBrJfbUfCoIydGHoqXUWIoutMsvmd:/WPnfYBrJWIydGHotoSPC

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral24/memory/4632-0-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral24/memory/4632-1-0x0000000010000000-0x000000001004D000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5064	4632	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 4632	2036	rundll32.exe	91
PID 2036 wrote to memory of 4632	2036	rundll32.exe	91
PID 2036 wrote to memory of 4632	2036	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\office2019pjb_9435\office2019pjb\OTool\files\Thunder\xldl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\office2019pjb_9435\office2019pjb\OTool\files\Thunder\xldl.dll,#1
  2⤵
  PID:4632
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 644
    3⤵
    - Program crash
    PID:5064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4632 -ip 4632
1⤵
PID:2944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4204,i,6593821857742176458,13646536021844995125,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:8
1⤵
PID:944

memory/4632-0-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/4632-1-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download