c62cab81c8b8f84870774963a8885b4b030acd792a33947179f4baa32d5788a3

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
18/09/2022, 23:07

Target

c62cab81c8b8f84870774963a8885b4b030acd792a33947179f4baa32d5788a3.dll
Size

21KB
MD5

b4737adea4a5ce2345c739fe656a367d
SHA1

68ff595bd13e94978c728e49239667a786b4a04c
SHA256

c62cab81c8b8f84870774963a8885b4b030acd792a33947179f4baa32d5788a3
SHA512

7d5867b81a8e5a4b4283f5148db892b4fcca02ccd43f17e43fbdafd538e524245d6a95c492b274d7bb4ca229e93881033ea6947a81f8b7e121f8d590c28e21e5
SSDEEP

384:zhQmM2o6YgypY+QTHdAyUR4NckkJTJr3yBo4Nb6d0V7+sk/5Rz:zh22RYtpcq4SxsNWd05Ax

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/628-56-0x0000000010000000-0x0000000010015000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 628	960	rundll32.exe	27
PID 960 wrote to memory of 628	960	rundll32.exe	27
PID 960 wrote to memory of 628	960	rundll32.exe	27
PID 960 wrote to memory of 628	960	rundll32.exe	27
PID 960 wrote to memory of 628	960	rundll32.exe	27
PID 960 wrote to memory of 628	960	rundll32.exe	27
PID 960 wrote to memory of 628	960	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c62cab81c8b8f84870774963a8885b4b030acd792a33947179f4baa32d5788a3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c62cab81c8b8f84870774963a8885b4b030acd792a33947179f4baa32d5788a3.dll,#1
  2⤵
  PID:628

memory/628-55-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/628-56-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download