1cae65672863776d22ff6d1a60534dc2d0c8cc8747aceadf78dc569f202da5e3

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-10-2022 07:43

Target

1cae65672863776d22ff6d1a60534dc2d0c8cc8747aceadf78dc569f202da5e3.dll
Size

71KB
MD5

49deca3aa21e419c7b36c86f5b860a65
SHA1

029f3a2019bf1615681cbaaca90254a124280c7f
SHA256

1cae65672863776d22ff6d1a60534dc2d0c8cc8747aceadf78dc569f202da5e3
SHA512

b778a4d4725dac4034f9cc3f9e8c65382aa3e0a184080e123e8ba095a14e5457b8beb2cef257a417525d3a97e1bb741e95bac168d7537822d9d0a3dc799fdee1
SSDEEP

1536:RV38Lba5NMXUS3dK+/etmdwaUG2Na5JddnHm:T3Iba5NMbdvetmqByxdnG

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1460-56-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1460	2044	rundll32.exe	26
PID 2044 wrote to memory of 1460	2044	rundll32.exe	26
PID 2044 wrote to memory of 1460	2044	rundll32.exe	26
PID 2044 wrote to memory of 1460	2044	rundll32.exe	26
PID 2044 wrote to memory of 1460	2044	rundll32.exe	26
PID 2044 wrote to memory of 1460	2044	rundll32.exe	26
PID 2044 wrote to memory of 1460	2044	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1cae65672863776d22ff6d1a60534dc2d0c8cc8747aceadf78dc569f202da5e3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1cae65672863776d22ff6d1a60534dc2d0c8cc8747aceadf78dc569f202da5e3.dll,#1
  2⤵
  PID:1460

memory/1460-54-0x0000000000000000-mapping.dmp

Download
memory/1460-55-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download
memory/1460-56-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download