5ac90ded16ebe4ad429814e349fcc77f3918d71a2432ec5c88089bde9dad1aee

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 05:00 UTC

Target

$PLUGINSDIR/Aero.dll
Size

7KB
MD5

2329db4688b46b8cde1297575a8fc94c
SHA1

dcaf28dd61992df3ffc64468e1ff487193d83ad8
SHA256

2c58ec428c767ce05e3b2c18ef1e1d9be0d6cd3a97c9f33c95666ea9a66caa9b
SHA512

1e6571c14faab22e6169c21867862bbaacd17bd0d8b589d8403150c62cf022b137428b681d5cffc51b6c772cc04d1213a142f1781dd3a38892daea93e2241994
SSDEEP

192:M6nmPtvco460e35M76v9gTnDg9ZLbG7ChBsZ:UvcoIYKnDg9xhs

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral5/memory/2336-1-0x0000000074E70000-0x0000000074E7A000-memory.dmp	upx
behavioral5/memory/2336-3-0x0000000074E70000-0x0000000074E7A000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
292	2336	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 2336	756	rundll32.exe	28
PID 756 wrote to memory of 2336	756	rundll32.exe	28
PID 756 wrote to memory of 2336	756	rundll32.exe	28
PID 756 wrote to memory of 2336	756	rundll32.exe	28
PID 756 wrote to memory of 2336	756	rundll32.exe	28
PID 756 wrote to memory of 2336	756	rundll32.exe	28
PID 756 wrote to memory of 2336	756	rundll32.exe	28
PID 2336 wrote to memory of 292	2336	rundll32.exe	29
PID 2336 wrote to memory of 292	2336	rundll32.exe	29
PID 2336 wrote to memory of 292	2336	rundll32.exe	29
PID 2336 wrote to memory of 292	2336	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Aero.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Aero.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 220
    3⤵
    - Program crash
    PID:292

memory/2336-2-0x0000000074E60000-0x0000000074E6A000-memory.dmp

Filesize
40KB

Download
memory/2336-1-0x0000000074E70000-0x0000000074E7A000-memory.dmp

Filesize
40KB

Download
memory/2336-0-0x0000000074E60000-0x0000000074E6A000-memory.dmp

Filesize
40KB

Download
memory/2336-3-0x0000000074E70000-0x0000000074E7A000-memory.dmp

Filesize
40KB

Download
memory/2336-5-0x0000000074E60000-0x0000000074E6A000-memory.dmp

Filesize
40KB

Download
memory/2336-6-0x0000000074E60000-0x0000000074E6A000-memory.dmp

Filesize
40KB

Download