aa6e3a3f06fbf1a9b6fd3c03afd97abb83adcaa63e68bf41e83fe0ff2aff02e1

Analysis

max time kernel
91s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09-07-2024 23:30

Target

AutoGuarder2.3.7.350/Vdata.dll
Size

292KB
MD5

de79e4c838a1dcf3f3d54eab5fc63681
SHA1

ac447f0655f4554813b749cf897ac295880696f1
SHA256

32a642a8da1dc91a23da73034667450cf93027c9d97e21a598d818cc04fb925c
SHA512

83c73f8cd8910f130cea396ad273c429f6fd8ed55b39cd6e72d67ee6ecf439d53b1591591cb0481141afe1daa4fe544a209b06c568c5903b5a7f34fcbb8a58af
SSDEEP

3072:txWd0it/JuCt7HBI0EVSdQq4gc9TgkCAzrK1FwWmLPiKMe0RzTK0cpH2aNDyhYmP:uSitPBnZdQqtcgurAou1edHC+rrXRw/

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral8/memory/1280-0-0x0000000010000000-0x0000000010215000-memory.dmp	upx
behavioral8/memory/1280-2-0x0000000010000000-0x0000000010215000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4224	1280	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 1280	4764	rundll32.exe	82
PID 4764 wrote to memory of 1280	4764	rundll32.exe	82
PID 4764 wrote to memory of 1280	4764	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AutoGuarder2.3.7.350\Vdata.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AutoGuarder2.3.7.350\Vdata.dll,#1
  2⤵
  PID:1280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1280 -s 620
    3⤵
    - Program crash
    PID:4224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1280 -ip 1280
1⤵
PID:440

memory/1280-0-0x0000000010000000-0x0000000010215000-memory.dmp

Filesize
2.1MB

Download
memory/1280-2-0x0000000010000000-0x0000000010215000-memory.dmp

Filesize
2.1MB

Download