bfa900d0c124e863809c9af664bf40984fdef6611cd1ddf9f006d9cee7d62929

Analysis

max time kernel
18s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 03:35

Target

bfa900d0c124e863809c9af664bf40984fdef6611cd1ddf9f006d9cee7d62929.dll
Size

4KB
MD5

441f3e378910fe69b179f1463793f750
SHA1

720f230a5ae1d312c19aedfa71b5a3bbaa9e6a59
SHA256

bfa900d0c124e863809c9af664bf40984fdef6611cd1ddf9f006d9cee7d62929
SHA512

e8d809d7a51c11aeba239e3742958f340075e6034f80dd0270ebe76b99e262b90ebadbce02b2b8d4719b1ae317b70bb2019dc2aeb969b3524a5883a6821998c4
SSDEEP

96:TRphMzf8S0FL3n2HW27CCLE1juMZHjJelRb8:NpOr8SqX2HbOCESYklu

Score

9^/10

upx

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/memory/1724-57-0x0000000074C40000-0x0000000074C48000-memory.dmp	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1724-57-0x0000000074C40000-0x0000000074C48000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1724	1788	rundll32.exe	28
PID 1788 wrote to memory of 1724	1788	rundll32.exe	28
PID 1788 wrote to memory of 1724	1788	rundll32.exe	28
PID 1788 wrote to memory of 1724	1788	rundll32.exe	28
PID 1788 wrote to memory of 1724	1788	rundll32.exe	28
PID 1788 wrote to memory of 1724	1788	rundll32.exe	28
PID 1788 wrote to memory of 1724	1788	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bfa900d0c124e863809c9af664bf40984fdef6611cd1ddf9f006d9cee7d62929.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bfa900d0c124e863809c9af664bf40984fdef6611cd1ddf9f006d9cee7d62929.dll,#1
  2⤵
  PID:1724

memory/1724-55-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/1724-56-0x0000000074C50000-0x0000000074C58000-memory.dmp

Filesize
32KB

Download
memory/1724-57-0x0000000074C40000-0x0000000074C48000-memory.dmp

Filesize
32KB

Download