76063a54ec28f071c72d73dfed45353348667dedd155848a4f5d7018c4f4c9a2

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 14:19

Target

76063a54ec28f071c72d73dfed45353348667dedd155848a4f5d7018c4f4c9a2.dll
Size

205KB
MD5

6aa182124f62672c2bb39d092335ddc0
SHA1

2a4fc40f1c1d6837114e2734b4c2f00128c45f77
SHA256

76063a54ec28f071c72d73dfed45353348667dedd155848a4f5d7018c4f4c9a2
SHA512

558e9aaccabc8a80e74bfa805d4f2257f1c80fe6bc1f2a680677f3bec2a32a579283204577081137add6aa7edc8fc9257d66beaffe9d82c72c80b19b572d9725
SSDEEP

3072:narvEqiwAX2x75rmhS75cAqStJ9QgxzgMdlqScP3pAofK1FmO:nq8qiFGtUsuANagtgEPIAoS1Fr

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1700-58-0x0000000000270000-0x00000000002A2000-memory.dmp	upx
behavioral1/memory/1700-59-0x0000000000270000-0x00000000002A2000-memory.dmp	upx
behavioral1/memory/1700-60-0x0000000000270000-0x00000000002CB000-memory.dmp	upx
behavioral1/memory/1700-65-0x0000000000270000-0x00000000002CB000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
892	rundll32.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~3\8lwqjzt7do.cpp	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1700	1368	rundll32.exe	27
PID 1368 wrote to memory of 1700	1368	rundll32.exe	27
PID 1368 wrote to memory of 1700	1368	rundll32.exe	27
PID 1368 wrote to memory of 1700	1368	rundll32.exe	27
PID 1368 wrote to memory of 1700	1368	rundll32.exe	27
PID 1368 wrote to memory of 1700	1368	rundll32.exe	27
PID 1368 wrote to memory of 1700	1368	rundll32.exe	27
PID 1700 wrote to memory of 892	1700	rundll32.exe	28
PID 1700 wrote to memory of 892	1700	rundll32.exe	28
PID 1700 wrote to memory of 892	1700	rundll32.exe	28
PID 1700 wrote to memory of 892	1700	rundll32.exe	28
PID 1700 wrote to memory of 892	1700	rundll32.exe	28
PID 1700 wrote to memory of 892	1700	rundll32.exe	28
PID 1700 wrote to memory of 892	1700	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\76063a54ec28f071c72d73dfed45353348667dedd155848a4f5d7018c4f4c9a2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\76063a54ec28f071c72d73dfed45353348667dedd155848a4f5d7018c4f4c9a2.dll,#1
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\PROGRA~3\8lwqjzt7do.cpp,XXS1
    3⤵
    - Loads dropped DLL
    PID:892

C:\PROGRA~3\8lwqjzt7do.cpp

Filesize
205KB

MD5
6aa182124f62672c2bb39d092335ddc0

SHA1
2a4fc40f1c1d6837114e2734b4c2f00128c45f77

SHA256
76063a54ec28f071c72d73dfed45353348667dedd155848a4f5d7018c4f4c9a2

SHA512
558e9aaccabc8a80e74bfa805d4f2257f1c80fe6bc1f2a680677f3bec2a32a579283204577081137add6aa7edc8fc9257d66beaffe9d82c72c80b19b572d9725

Download Submit
\PROGRA~3\8lwqjzt7do.cpp

Filesize
205KB

MD5
6aa182124f62672c2bb39d092335ddc0

SHA1
2a4fc40f1c1d6837114e2734b4c2f00128c45f77

SHA256
76063a54ec28f071c72d73dfed45353348667dedd155848a4f5d7018c4f4c9a2

SHA512
558e9aaccabc8a80e74bfa805d4f2257f1c80fe6bc1f2a680677f3bec2a32a579283204577081137add6aa7edc8fc9257d66beaffe9d82c72c80b19b572d9725

Download Submit
memory/1700-55-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download
memory/1700-58-0x0000000000270000-0x00000000002A2000-memory.dmp

Filesize
200KB

Download
memory/1700-59-0x0000000000270000-0x00000000002A2000-memory.dmp

Filesize
200KB

Download
memory/1700-60-0x0000000000270000-0x00000000002CB000-memory.dmp

Filesize
364KB

Download
memory/1700-65-0x0000000000270000-0x00000000002CB000-memory.dmp

Filesize
364KB

Download