e66d33caff1a5048e4a5b05e52de6b92957aadd9663265afe495965f9769a725

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 18:14

Target

$_2_/TSSafeEdit.dll
Size

40KB
MD5

f302d404d0b29377a54f1e5b76f44595
SHA1

05f223ba86e6b8a2bd4cfede0bed5aa39d683328
SHA256

3c97da7b12ac519103851a23f56cc0b75df7b11f719813fc0d579d4e0f941718
SHA512

d33f682953514cf3abb786237f3e50774d444b525456ec025f1e41e049e0c250285cc22f6ecdcdbe0e1919716a135135f60a7cf2323154afff0045d1ef99d41e
SSDEEP

768:G2qJPIlSUR/9cT7DEGLH+DNLz/eyGI12ARqfhuXd04RTvLWHbCjr:v6PqS89a3+hWyZ12jJut04RTva7C3

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral17/memory/2144-1-0x0000000010000000-0x0000000010016000-memory.dmp	upx
behavioral17/memory/2144-0-0x0000000010000000-0x0000000010016000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2868	2144	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2144	1720	rundll32.exe	29
PID 1720 wrote to memory of 2144	1720	rundll32.exe	29
PID 1720 wrote to memory of 2144	1720	rundll32.exe	29
PID 1720 wrote to memory of 2144	1720	rundll32.exe	29
PID 1720 wrote to memory of 2144	1720	rundll32.exe	29
PID 1720 wrote to memory of 2144	1720	rundll32.exe	29
PID 1720 wrote to memory of 2144	1720	rundll32.exe	29
PID 2144 wrote to memory of 2868	2144	rundll32.exe	30
PID 2144 wrote to memory of 2868	2144	rundll32.exe	30
PID 2144 wrote to memory of 2868	2144	rundll32.exe	30
PID 2144 wrote to memory of 2868	2144	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_2_\TSSafeEdit.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_2_\TSSafeEdit.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 224
    3⤵
    - Program crash
    PID:2868

memory/2144-1-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/2144-0-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download