30e07e1ffb8283f4c30c9bd643e759cf8246bee8e3bfa4de8ea30beac532a68d

Analysis

max time kernel
133s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 14:52

Target

$TEMP/upholder.dll
Size

52KB
MD5

de0f2c4a5b7c7974f19f48b08b3d55d7
SHA1

fb4eea0fa23f0dffa17a141dd9a66e919a79d6c4
SHA256

ae257e13507e2980446867e3b5cfb9a5c57c2d09c24079d59667938e82c204b7
SHA512

812ad695df0188565f31e3db646ac7a41db41320bc3b03ea504dba8f027018661cc9fd47a38833df28e3db1bcfa45cf2b244c9231bf6bca6f01ddd81ff578c6e
SSDEEP

384:dNGrfGDudTR3VFKmlkYtlosjEfXyyoSwWa3C9svaAU+k9SVItAEVN8aUYwZS7PrX:mrD9RHHbMyuwdC9s7U+kJAEVN8azX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3596	3600	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 3600	3640	rundll32.exe	82
PID 3640 wrote to memory of 3600	3640	rundll32.exe	82
PID 3640 wrote to memory of 3600	3640	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\upholder.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\upholder.dll,#1
  2⤵
  PID:3600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 568
    3⤵
    - Program crash
    PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3600 -ip 3600
1⤵
PID:5132