4ebf9a60d787af4178ef5786d5228414fdc37c258aa5894b194f786f2932cdd9

Analysis

max time kernel
30s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 17:00

Target

4ebf9a60d787af4178ef5786d5228414fdc37c258aa5894b194f786f2932cdd9.dll
Size

16KB
MD5

26031c2373fa9711950e0022f2b8b64d
SHA1

cc1682eb3f098a618690f3c4d7affb74def3701a
SHA256

4ebf9a60d787af4178ef5786d5228414fdc37c258aa5894b194f786f2932cdd9
SHA512

64b97abc45fec925c4f1bbd09a62cc21b92dbf0f4d210e465ac99e14617f50002cee2d7075b192f7f37631084b045ab3bef807aeeb89861b3e52670f3a0104b3
SSDEEP

384:Eg/9m7f9OzuPlMco4F5hAK8gAEOK4/vGzpSApY:KfAzBco0TAK8dEVSvGzzi

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1944-56-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1944-57-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ebf9a60d787af4178ef5786d5228414fdc37c258aa5894b194f786f2932cdd9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ebf9a60d787af4178ef5786d5228414fdc37c258aa5894b194f786f2932cdd9.dll,#1
  2⤵
  PID:1944

memory/1944-55-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/1944-56-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1944-57-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download