e66d33caff1a5048e4a5b05e52de6b92957aadd9663265afe495965f9769a725

Analysis

max time kernel
141s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 18:14

Target

$_2_/TSSafeEdit.dll
Size

40KB
MD5

f302d404d0b29377a54f1e5b76f44595
SHA1

05f223ba86e6b8a2bd4cfede0bed5aa39d683328
SHA256

3c97da7b12ac519103851a23f56cc0b75df7b11f719813fc0d579d4e0f941718
SHA512

d33f682953514cf3abb786237f3e50774d444b525456ec025f1e41e049e0c250285cc22f6ecdcdbe0e1919716a135135f60a7cf2323154afff0045d1ef99d41e
SSDEEP

768:G2qJPIlSUR/9cT7DEGLH+DNLz/eyGI12ARqfhuXd04RTvLWHbCjr:v6PqS89a3+hWyZ12jJut04RTva7C3

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral16/memory/3724-0-0x0000000010000000-0x0000000010016000-memory.dmp	upx
behavioral16/memory/3724-1-0x0000000010000000-0x0000000010016000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3188	3724	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 3724	2548	rundll32.exe	90
PID 2548 wrote to memory of 3724	2548	rundll32.exe	90
PID 2548 wrote to memory of 3724	2548	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_2_\TSSafeEdit.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_2_\TSSafeEdit.dll,#1
  2⤵
  PID:3724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3724 -s 604
    3⤵
    - Program crash
    PID:3188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3724 -ip 3724
1⤵
PID:2120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1312 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
1⤵
PID:916

memory/3724-0-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/3724-1-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download