0874180b54f53b76c20c33c5920df2752759ee842a353974b2a6f60f491fa840

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 23:22

Target

0874180b54f53b76c20c33c5920df2752759ee842a353974b2a6f60f491fa840.dll
Size

66KB
MD5

6704da59004851e98232c61e6a57053c
SHA1

327f45c4cb24eb9bf2d0becae832f77e7a046bb1
SHA256

0874180b54f53b76c20c33c5920df2752759ee842a353974b2a6f60f491fa840
SHA512

1a5c960d214aa76345d6e8a1eada733ceb89da284854746cbbe1cb92fcc3b872798b77b259e4017993aba4922d66e8ad7432ea39ca83ee1502185aaec49adacf
SSDEEP

1536:5muc0YvfEp31fAHamDxjJN4tXv8XlnlYT7UBUr2ze:9B8fQ3SBDxJNOvwSme

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1472-56-0x0000000010000000-0x0000000010052000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0874180b54f53b76c20c33c5920df2752759ee842a353974b2a6f60f491fa840.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0874180b54f53b76c20c33c5920df2752759ee842a353974b2a6f60f491fa840.dll,#1
  2⤵
  PID:1472

memory/1472-54-0x0000000000000000-mapping.dmp

Download
memory/1472-55-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/1472-56-0x0000000010000000-0x0000000010052000-memory.dmp

Filesize
328KB

Download