3d4602af73ce268c22d3aa3f1618a302efc8eb72150d1613368237ac6f41be5e

Analysis

max time kernel
23s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 15:57

Target

3d4602af73ce268c22d3aa3f1618a302efc8eb72150d1613368237ac6f41be5e.dll
Size

115KB
MD5

48d46c950cad769d1a6ab34a9a2df703
SHA1

60ef16426af642d7c12693e703a8d4cc5bbe9988
SHA256

3d4602af73ce268c22d3aa3f1618a302efc8eb72150d1613368237ac6f41be5e
SHA512

c8d40151f31e377db139d41df0026395d7be647c14b4b064b3ff69f9bdf452d3b23caac8c4692ff147d5b7ab8352f9f9608ed432cff4a21e2706205be5b77d10
SSDEEP

3072:tGe98hK0U+rB1QlJksW/sBncpppiXOLNweDoTWlVz:tG0hk/y+NDFlVz

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1952-56-0x0000000000200000-0x000000000025C000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1952	2012	rundll32.exe	28
PID 2012 wrote to memory of 1952	2012	rundll32.exe	28
PID 2012 wrote to memory of 1952	2012	rundll32.exe	28
PID 2012 wrote to memory of 1952	2012	rundll32.exe	28
PID 2012 wrote to memory of 1952	2012	rundll32.exe	28
PID 2012 wrote to memory of 1952	2012	rundll32.exe	28
PID 2012 wrote to memory of 1952	2012	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d4602af73ce268c22d3aa3f1618a302efc8eb72150d1613368237ac6f41be5e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d4602af73ce268c22d3aa3f1618a302efc8eb72150d1613368237ac6f41be5e.dll,#1
  2⤵
  PID:1952

memory/1952-55-0x00000000758C1000-0x00000000758C3000-memory.dmp

Filesize
8KB

Download
memory/1952-56-0x0000000000200000-0x000000000025C000-memory.dmp

Filesize
368KB

Download