1dfdd5e0c7f45aaa085f152e7d81d45a3034c1992809322af421f948615cf45b

Analysis

max time kernel
38s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 09:56

Target

1dfdd5e0c7f45aaa085f152e7d81d45a3034c1992809322af421f948615cf45b.dll
Size

173KB
MD5

f7fecd372cdc481f0fe5b37cd8b06e75
SHA1

080bda91b711db70f2abe554ca8e8914ce3e4557
SHA256

1dfdd5e0c7f45aaa085f152e7d81d45a3034c1992809322af421f948615cf45b
SHA512

87b6aca8bbeb800660fba888fbb5e94a9f1131d7f2ccfa4d8dfdbe489c930fe665017096d2efe02daa890379db93580f756858024e50d4ecf5e299ed93c68909
SSDEEP

3072:wzXX/wvYsFDXMpkiw/vLjUmK+g06ckzerFIMQC4JO4D1vLB:EXIw+G6Ej0kzeIMQC4I4D1vL

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1980-56-0x0000000010000000-0x0000000010080000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1980	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1980	1976	rundll32.exe	26
PID 1976 wrote to memory of 1980	1976	rundll32.exe	26
PID 1976 wrote to memory of 1980	1976	rundll32.exe	26
PID 1976 wrote to memory of 1980	1976	rundll32.exe	26
PID 1976 wrote to memory of 1980	1976	rundll32.exe	26
PID 1976 wrote to memory of 1980	1976	rundll32.exe	26
PID 1976 wrote to memory of 1980	1976	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1dfdd5e0c7f45aaa085f152e7d81d45a3034c1992809322af421f948615cf45b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1dfdd5e0c7f45aaa085f152e7d81d45a3034c1992809322af421f948615cf45b.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1980

memory/1980-55-0x00000000754E1000-0x00000000754E3000-memory.dmp

Filesize
8KB

Download
memory/1980-56-0x0000000010000000-0x0000000010080000-memory.dmp

Filesize
512KB

Download