10d78fbad39545b9eb6b5d707159819beacf3d99148112212da374ae8bece49e

Analysis

max time kernel
142s
max time network
128s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 01:54

Target

$PLUGINSDIR/ProcDll.dll
Size

19KB
MD5

62d2f0a425fab6799db0b7b4eb939696
SHA1

0a4487159fcec57d63d172559c51e75a184ae559
SHA256

7adc45f2e2b5f5fdeaa7ff5a83bac63fef729979702f4997ecb0a8b6a1a0f785
SHA512

cbebe63ab2797bb7f8d1d3fa96b8e6839148e20c56b326682d8aff55ef28b16b75c9bfab6b0011847945f0842a30d5bd8faa038b8fe38b356941863d62b7992f
SSDEEP

384:yovD5PJ+3KrgkUb5EwtiIxwTXKfK0ma6mUY00/NaKEs3:DdPY3KrkdtiIAkl6m5jxE

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral7/memory/1208-0-0x0000000010000000-0x0000000010013000-memory.dmp	upx
behavioral7/memory/1208-1-0x0000000010000000-0x0000000010013000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3052	1208	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 1208	2052	rundll32.exe	28
PID 2052 wrote to memory of 1208	2052	rundll32.exe	28
PID 2052 wrote to memory of 1208	2052	rundll32.exe	28
PID 2052 wrote to memory of 1208	2052	rundll32.exe	28
PID 2052 wrote to memory of 1208	2052	rundll32.exe	28
PID 2052 wrote to memory of 1208	2052	rundll32.exe	28
PID 2052 wrote to memory of 1208	2052	rundll32.exe	28
PID 1208 wrote to memory of 3052	1208	rundll32.exe	29
PID 1208 wrote to memory of 3052	1208	rundll32.exe	29
PID 1208 wrote to memory of 3052	1208	rundll32.exe	29
PID 1208 wrote to memory of 3052	1208	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ProcDll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ProcDll.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 232
    3⤵
    - Program crash
    PID:3052

memory/1208-0-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1208-1-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download