24031fdf0fb620ce4f88cc9fc14f35a45e8f2d2ce9e7b970c19850bc7961cd46

Analysis

max time kernel
29s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 17:00

Target

24031fdf0fb620ce4f88cc9fc14f35a45e8f2d2ce9e7b970c19850bc7961cd46.dll
Size

16KB
MD5

611d46ce4b3ce5b0fb481929a12af4df
SHA1

11d4c10730743c36f3b659a4b0cbc5e64f171a87
SHA256

24031fdf0fb620ce4f88cc9fc14f35a45e8f2d2ce9e7b970c19850bc7961cd46
SHA512

e9182f6eb0079d1672302e1acb579b96a73b65bf2666259e3d16dfd9aee0c34c00345c1c683d5ea0d93c5d81c8c468046ea296bd01db97d24b4c351513b53f99
SSDEEP

384:Eg/9m7f9OzuPlMco4F5hAK8gAEOK4/vGzpSAph:KfAzBco0TAK8dEVSvGzzf

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1892-56-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1892-57-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1892	2004	rundll32.exe	28
PID 2004 wrote to memory of 1892	2004	rundll32.exe	28
PID 2004 wrote to memory of 1892	2004	rundll32.exe	28
PID 2004 wrote to memory of 1892	2004	rundll32.exe	28
PID 2004 wrote to memory of 1892	2004	rundll32.exe	28
PID 2004 wrote to memory of 1892	2004	rundll32.exe	28
PID 2004 wrote to memory of 1892	2004	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24031fdf0fb620ce4f88cc9fc14f35a45e8f2d2ce9e7b970c19850bc7961cd46.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\24031fdf0fb620ce4f88cc9fc14f35a45e8f2d2ce9e7b970c19850bc7961cd46.dll,#1
  2⤵
  PID:1892

memory/1892-55-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download
memory/1892-56-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1892-57-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download