ab0f259c77d49bb41e8dfb47ab63d5c35223b44445604ca55da2cbf018738c9b

Analysis

max time kernel
29s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 22:59

Target

ab0f259c77d49bb41e8dfb47ab63d5c35223b44445604ca55da2cbf018738c9b.dll
Size

55KB
MD5

08e016a32cafc2d04e9c2daf266f1990
SHA1

42306fa8c20f9ce176bdc2d6036531eea6e350fe
SHA256

ab0f259c77d49bb41e8dfb47ab63d5c35223b44445604ca55da2cbf018738c9b
SHA512

a8f0c7236c2cedd8cc7678bb7891714831c037f36c14370f919e10ba15c374f270489122f5e55e82e65faecacee6b67e300d3b7758d2424012769e8c74d73f25
SSDEEP

768:LRBU3zyN0mv7t7T16rKkdeb2hmVfdA7SCrjaHrdkdkM/4CSTvMBO0Kfo2/:LGIfv7t7T1Gd8d6SSeKKyST0Bf4V/

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1996-56-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1996	1736	rundll32.exe	27
PID 1736 wrote to memory of 1996	1736	rundll32.exe	27
PID 1736 wrote to memory of 1996	1736	rundll32.exe	27
PID 1736 wrote to memory of 1996	1736	rundll32.exe	27
PID 1736 wrote to memory of 1996	1736	rundll32.exe	27
PID 1736 wrote to memory of 1996	1736	rundll32.exe	27
PID 1736 wrote to memory of 1996	1736	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab0f259c77d49bb41e8dfb47ab63d5c35223b44445604ca55da2cbf018738c9b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab0f259c77d49bb41e8dfb47ab63d5c35223b44445604ca55da2cbf018738c9b.dll,#1
  2⤵
  PID:1996

memory/1996-55-0x0000000075E51000-0x0000000075E53000-memory.dmp

Filesize
8KB

Download
memory/1996-56-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download