04fced163a422e9a752ff0efdca5ec862278903283c179c90138b02295320df8

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 23:04

Target

04fced163a422e9a752ff0efdca5ec862278903283c179c90138b02295320df8.dll
Size

4KB
MD5

50e45ddbf16d07344b5f4680d8d2ae80
SHA1

7f894c036cd95a0f8282ee3d9871b6e3b405b6d8
SHA256

04fced163a422e9a752ff0efdca5ec862278903283c179c90138b02295320df8
SHA512

37ccacc89d91134c18319734109467e7681bb62dbd833ec1731094e5eba6aa852b20880d927eb3126beaa264fdd0eca289b9f1d63c051d66991f97af44cc1d70
SSDEEP

48:a5zuMqBcq06phM/wwWLSeJY8JTa6Il+Ly0F1nUZUtHukTMEN52mDEyarcWtkpk7+:TRphMzf8Jd8UZJYMzQ7c0kpk7ge+

Score

9^/10

upx

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/memory/1892-57-0x0000000074C00000-0x0000000074C08000-memory.dmp	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1892-57-0x0000000074C00000-0x0000000074C08000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1892	1160	rundll32.exe	26
PID 1160 wrote to memory of 1892	1160	rundll32.exe	26
PID 1160 wrote to memory of 1892	1160	rundll32.exe	26
PID 1160 wrote to memory of 1892	1160	rundll32.exe	26
PID 1160 wrote to memory of 1892	1160	rundll32.exe	26
PID 1160 wrote to memory of 1892	1160	rundll32.exe	26
PID 1160 wrote to memory of 1892	1160	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04fced163a422e9a752ff0efdca5ec862278903283c179c90138b02295320df8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\04fced163a422e9a752ff0efdca5ec862278903283c179c90138b02295320df8.dll,#1
  2⤵
  PID:1892

memory/1892-55-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download
memory/1892-56-0x0000000074C10000-0x0000000074C18000-memory.dmp

Filesize
32KB

Download
memory/1892-57-0x0000000074C00000-0x0000000074C08000-memory.dmp

Filesize
32KB

Download
memory/1892-58-0x0000000074C10000-0x0000000074C18000-memory.dmp

Filesize
32KB

Download