79c2733f6aea8cc0b2cbba6b2f450b7e4617d3666082cd7ae841d6fabe7901fd

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-06-2024 12:45

Target

VirusShare_00d9d5a0319cddef48add9257d4721df.dll
Size

204KB
MD5

00d9d5a0319cddef48add9257d4721df
SHA1

4da40bf0a2c94cfa25ccface3fd51f64bdf39b82
SHA256

79c2733f6aea8cc0b2cbba6b2f450b7e4617d3666082cd7ae841d6fabe7901fd
SHA512

d7b77edf2e0a3be0bf4020f010d97dd1d0016b40b17a87b11b0c450b7c65bc0b3fc5d5db6a1704bd1ea43b139845bbefa7d979466fb36f855f33ba18ccce235f
SSDEEP

6144:f/FCpGUkx6ZusGqgN4KDnr59x1AZgSu7koS:gYH1N4YbPAZgSpoS

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/3460-0-0x0000000000400000-0x0000000000464000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1168 3460 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1168	3460	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3268 wrote to memory of 3460	3268	rundll32.exe	rundll32.exe
PID 3268 wrote to memory of 3460	3268	rundll32.exe	rundll32.exe
PID 3268 wrote to memory of 3460	3268	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VirusShare_00d9d5a0319cddef48add9257d4721df.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3268

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VirusShare_00d9d5a0319cddef48add9257d4721df.dll,#1
2⤵
PID:3460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3460 -s 560
3⤵
- Program crash
PID:1168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3460 -ip 3460
1⤵
PID:2668

memory/3460-1-0x0000000001010000-0x0000000001024000-memory.dmp

Filesize
80KB

Download
memory/3460-0-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download