6fc99d026a7d55c228f488550d6a0424f6575e9648acfdc02c093e5efe3cf705

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 05:40

Target

53d0cb45f964c03bded5e6d089a42940N.dll
Size

331KB
MD5

53d0cb45f964c03bded5e6d089a42940
SHA1

ec9e35d2281658c8d75cfa8d0fce8e7d5f0aa92e
SHA256

6fc99d026a7d55c228f488550d6a0424f6575e9648acfdc02c093e5efe3cf705
SHA512

e35bfe7dce0afd56e61fac75358c56ec12b7f3af3f716f4d51ef143a84172b72fdf00f8c00e76c2f0604594b31f5a00a6c5d71f2fb8d9e3b4d3ae2eb186d1eec
SSDEEP

6144:VGR+02jnFt8dq88ivTXXiosR/35P+kJI2n/6C3NRkFPIQT9a29U:f02nErTXXerP+kJJnNTkz9a29U

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2188-0-0x0000000000D10000-0x0000000000E01000-memory.dmp	upx
behavioral2/memory/2188-1-0x0000000000D10000-0x0000000000E01000-memory.dmp	upx
behavioral2/memory/2188-2-0x0000000000D10000-0x0000000000E01000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3572	2188	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 2188	1332	rundll32.exe	83
PID 1332 wrote to memory of 2188	1332	rundll32.exe	83
PID 1332 wrote to memory of 2188	1332	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\53d0cb45f964c03bded5e6d089a42940N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\53d0cb45f964c03bded5e6d089a42940N.dll,#1
  2⤵
  PID:2188
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 716
    3⤵
    - Program crash
    PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2188 -ip 2188
1⤵
PID:3792

memory/2188-0-0x0000000000D10000-0x0000000000E01000-memory.dmp

Filesize
964KB

Download
memory/2188-1-0x0000000000D10000-0x0000000000E01000-memory.dmp

Filesize
964KB

Download
memory/2188-2-0x0000000000D10000-0x0000000000E01000-memory.dmp

Filesize
964KB

Download