7bf2849d08ac9eae9adbb59c2a2df6d475860baab614ab3eaca9f9c9d8962fbf

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 21:30

Target

7bf2849d08ac9eae9adbb59c2a2df6d475860baab614ab3eaca9f9c9d8962fbf.dll
Size

43KB
MD5

d1ace3de36a8401c544a85d6ad1dc7b3
SHA1

06eee66517cb496b4100f4d8396778c1a78f6ff5
SHA256

7bf2849d08ac9eae9adbb59c2a2df6d475860baab614ab3eaca9f9c9d8962fbf
SHA512

8156ddacde2520f46d82af22d328126087a6b57de2969754303ad98825e551baeef5900e0fb8ef7b661e043b3e62a13d5784593aee8141cb4a3ea05252f4b7e7
SSDEEP

768:oYbZTMTwyGCJl4pH4EFweGviJdb9dCx/3Q8GMK:oug5LJyiEFjFduQ

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/908-56-0x0000000010000000-0x000000001000C000-memory.dmp	upx
behavioral1/memory/908-58-0x0000000010000000-0x000000001000C000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2032	908	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 908	364	rundll32.exe	27
PID 364 wrote to memory of 908	364	rundll32.exe	27
PID 364 wrote to memory of 908	364	rundll32.exe	27
PID 364 wrote to memory of 908	364	rundll32.exe	27
PID 364 wrote to memory of 908	364	rundll32.exe	27
PID 364 wrote to memory of 908	364	rundll32.exe	27
PID 364 wrote to memory of 908	364	rundll32.exe	27
PID 908 wrote to memory of 2032	908	rundll32.exe	28
PID 908 wrote to memory of 2032	908	rundll32.exe	28
PID 908 wrote to memory of 2032	908	rundll32.exe	28
PID 908 wrote to memory of 2032	908	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7bf2849d08ac9eae9adbb59c2a2df6d475860baab614ab3eaca9f9c9d8962fbf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7bf2849d08ac9eae9adbb59c2a2df6d475860baab614ab3eaca9f9c9d8962fbf.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 224
    3⤵
    - Program crash
    PID:2032

memory/908-55-0x0000000075131000-0x0000000075133000-memory.dmp

Filesize
8KB

Download
memory/908-56-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/908-58-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download