6740951d3a5cd6882230aa0f86d5336e465cbc3f498de47ca4d6e7d5bec6ea67

Analysis

max time kernel
37s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 21:44

Target

6740951d3a5cd6882230aa0f86d5336e465cbc3f498de47ca4d6e7d5bec6ea67.dll
Size

316KB
MD5

902a471e1b303445071ca4d562e1af00
SHA1

25fcb170293a6f7c29a193fd06cf9d414fb62866
SHA256

6740951d3a5cd6882230aa0f86d5336e465cbc3f498de47ca4d6e7d5bec6ea67
SHA512

02fc94c36f4e251ce5ac02fca79b8c89f6395a2654a6406c0e74b85f43abc90399f8a35b5096dfed3e6b4de34d5b88259f0ef03e875a46a92a21f202d33373a0
SSDEEP

3072:QvlLqknarFs5Cy61iX/Lk+AOm65kq7dLizE50QXFBdjYwS/4gyYeglBN8HEjB1oO:QvlNPCykiX/w+A05V78E1T2ZyhCr7X

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1980-56-0x0000000000160000-0x000000000016D000-memory.dmp	upx
behavioral1/memory/1980-59-0x0000000000160000-0x000000000016D000-memory.dmp	upx
behavioral1/memory/1980-60-0x0000000000160000-0x000000000016D000-memory.dmp	upx
behavioral1/memory/1980-61-0x0000000000160000-0x000000000016D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1980	1976	rundll32.exe	26
PID 1976 wrote to memory of 1980	1976	rundll32.exe	26
PID 1976 wrote to memory of 1980	1976	rundll32.exe	26
PID 1976 wrote to memory of 1980	1976	rundll32.exe	26
PID 1976 wrote to memory of 1980	1976	rundll32.exe	26
PID 1976 wrote to memory of 1980	1976	rundll32.exe	26
PID 1976 wrote to memory of 1980	1976	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6740951d3a5cd6882230aa0f86d5336e465cbc3f498de47ca4d6e7d5bec6ea67.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6740951d3a5cd6882230aa0f86d5336e465cbc3f498de47ca4d6e7d5bec6ea67.dll,#1
  2⤵
  PID:1980

memory/1980-55-0x00000000754E1000-0x00000000754E3000-memory.dmp

Filesize
8KB

Download
memory/1980-56-0x0000000000160000-0x000000000016D000-memory.dmp

Filesize
52KB

Download
memory/1980-59-0x0000000000160000-0x000000000016D000-memory.dmp

Filesize
52KB

Download
memory/1980-60-0x0000000000160000-0x000000000016D000-memory.dmp

Filesize
52KB

Download
memory/1980-61-0x0000000000160000-0x000000000016D000-memory.dmp

Filesize
52KB

Download
memory/1980-62-0x0000000000166000-0x000000000016C000-memory.dmp

Filesize
24KB

Download
memory/1980-63-0x0000000000161000-0x0000000000166000-memory.dmp

Filesize
20KB

Download