e78d26153562caaff61c318a505ef2bcb811464ef361b2155f66a17954373a6a

Analysis

max time kernel
141s
max time network
32s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07-07-2024 22:51

Target

Scavenger.SV4.v2933732/Engine3D.dll
Size

2.5MB
MD5

aa255075baa9d1a49d788a57831da98a
SHA1

284699b486b43356dc778138071e7630eb8679f7
SHA256

903e6a8b9fb7fea5f9226e70777a74a30dc31c962af4b8fc2c23cdb8b65f0187
SHA512

a372b4ecf95ae591e692745da3419146c973dd385d12e1ab916d988d5a3ad40847d0a2e97ef5ea362177a5b4b230bcf63c194e0bfd76cfa902f39e040e7fd55d
SSDEEP

49152:yPLPyvIIqUFi3myZ+5l29Hzjh8dij58m/+1rVMgzwmtDv9NImmWNuxey:GPVIti3myZVZmWOmQOqwWDlNIZWNg

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral3/memory/3044-0-0x0000000073F40000-0x0000000074889000-memory.dmp	upx
behavioral3/memory/3044-3-0x0000000073F40000-0x0000000074889000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2212	3044	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 3044	2152	rundll32.exe	29
PID 2152 wrote to memory of 3044	2152	rundll32.exe	29
PID 2152 wrote to memory of 3044	2152	rundll32.exe	29
PID 2152 wrote to memory of 3044	2152	rundll32.exe	29
PID 2152 wrote to memory of 3044	2152	rundll32.exe	29
PID 2152 wrote to memory of 3044	2152	rundll32.exe	29
PID 2152 wrote to memory of 3044	2152	rundll32.exe	29
PID 3044 wrote to memory of 2212	3044	rundll32.exe	30
PID 3044 wrote to memory of 2212	3044	rundll32.exe	30
PID 3044 wrote to memory of 2212	3044	rundll32.exe	30
PID 3044 wrote to memory of 2212	3044	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Scavenger.SV4.v2933732\Engine3D.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Scavenger.SV4.v2933732\Engine3D.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 276
    3⤵
    - Program crash
    PID:2212

memory/3044-0-0x0000000073F40000-0x0000000074889000-memory.dmp

Filesize
9.3MB

Download
memory/3044-1-0x0000000073F30000-0x0000000074879000-memory.dmp

Filesize
9.3MB

Download
memory/3044-3-0x0000000073F40000-0x0000000074889000-memory.dmp

Filesize
9.3MB

Download
memory/3044-2-0x0000000073F20000-0x0000000074869000-memory.dmp

Filesize
9.3MB

Download
memory/3044-6-0x0000000073F30000-0x0000000074879000-memory.dmp

Filesize
9.3MB

Download
memory/3044-7-0x0000000073F20000-0x0000000074869000-memory.dmp

Filesize
9.3MB

Download