4b884c00d62b78b60eec7e99e98a4283504838c8bc83c5ef54186afd8374674f

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 18:19

Target

ChangerSteamByOstrog.dll
Size

14KB
MD5

d70a1f76186f5171fc9eb0c564aca078
SHA1

2347eb13fac9b3ab09cfe32e09497a3feccc2d28
SHA256

4b884c00d62b78b60eec7e99e98a4283504838c8bc83c5ef54186afd8374674f
SHA512

9bd280e9a37e0177463738e2e447043a20e24a22c8c4dd5bc83c22f53c31d29a3feafd10a808a97383704c618d7224c6bb6e52f60600db4c265b7f97a42bf10a
SSDEEP

384:3Wy69QW0gvujMnlrWroaNJawcudoD7Uy:3bWHuOZQnbcuyD7U

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1224-58-0x0000000000120000-0x0000000000132000-memory.dmp	upx
behavioral1/memory/1224-59-0x0000000000120000-0x0000000000132000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 1224	1624	rundll32.exe	28
PID 1624 wrote to memory of 1224	1624	rundll32.exe	28
PID 1624 wrote to memory of 1224	1624	rundll32.exe	28
PID 1624 wrote to memory of 1224	1624	rundll32.exe	28
PID 1624 wrote to memory of 1224	1624	rundll32.exe	28
PID 1624 wrote to memory of 1224	1624	rundll32.exe	28
PID 1624 wrote to memory of 1224	1624	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ChangerSteamByOstrog.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ChangerSteamByOstrog.dll,#1
  2⤵
  PID:1224

memory/1224-55-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/1224-56-0x0000000000110000-0x0000000000122000-memory.dmp

Filesize
72KB

Download
memory/1224-57-0x0000000000110000-0x0000000000122000-memory.dmp

Filesize
72KB

Download
memory/1224-58-0x0000000000120000-0x0000000000132000-memory.dmp

Filesize
72KB

Download
memory/1224-59-0x0000000000120000-0x0000000000132000-memory.dmp

Filesize
72KB

Download