09d9479fd4b059cf8a528d86b1da94a72c69453b930b47c99dec18fa67aceace

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 02:35

Target

09d9479fd4b059cf8a528d86b1da94a72c69453b930b47c99dec18fa67aceace.dll
Size

13KB
MD5

356b6489a562b75faffe91ac61499fef
SHA1

9a65b1be1c136de45600cd87b68b2a7086a576ef
SHA256

09d9479fd4b059cf8a528d86b1da94a72c69453b930b47c99dec18fa67aceace
SHA512

0b18e2c89622cbf94724cce974f92fa35695643345e42126e494df28b74d62761b05ecd60d529eea664341bec1c1d4f69ff1da6380409226334beab31b365667
SSDEEP

384:3faOKdwg/xpx3gO5nbg54gBlYx1S+SjltSk3:3iOKdV/N3gWgC+Yx1SZltJ

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/816-56-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 816	1464	rundll32.exe	27
PID 1464 wrote to memory of 816	1464	rundll32.exe	27
PID 1464 wrote to memory of 816	1464	rundll32.exe	27
PID 1464 wrote to memory of 816	1464	rundll32.exe	27
PID 1464 wrote to memory of 816	1464	rundll32.exe	27
PID 1464 wrote to memory of 816	1464	rundll32.exe	27
PID 1464 wrote to memory of 816	1464	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09d9479fd4b059cf8a528d86b1da94a72c69453b930b47c99dec18fa67aceace.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09d9479fd4b059cf8a528d86b1da94a72c69453b930b47c99dec18fa67aceace.dll,#1
  2⤵
  PID:816

memory/816-55-0x00000000758B1000-0x00000000758B3000-memory.dmp

Filesize
8KB

Download
memory/816-56-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download