0c0ddaa9841c5a12cd480a14400e8e9a4f558c22bace62264ee1cfeea7ba8bc2

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 02:54

Target

0c0ddaa9841c5a12cd480a14400e8e9a4f558c22bace62264ee1cfeea7ba8bc2.dll
Size

96KB
MD5

f0fee9d181d1b0a585399b905881ea9e
SHA1

794e8dca177cc8633d934005c55c9388f555c905
SHA256

0c0ddaa9841c5a12cd480a14400e8e9a4f558c22bace62264ee1cfeea7ba8bc2
SHA512

8e5580eedb020c4649dbde339bfe56dfdae00f5fe30aa8e21e37b1dfc725876038142674896c27f14f84dfe1268746f81d6810e720fdce86b451483cc78803f2
SSDEEP

1536:MGkZlPkC/XxHsBQvxjnj/rXxGGTEQtZAXDhEfiJZJHL0UA2SCYuD9bE4x9++o6aF:Elv/XxHRjnjrPEQcXDhMiJHLZA2SCYUa

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1672-56-0x0000000000180000-0x000000000018E000-memory.dmp	upx
behavioral1/memory/1672-60-0x0000000000180000-0x000000000018E000-memory.dmp	upx
behavioral1/memory/1672-59-0x0000000000180000-0x000000000018E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 1672	1380	rundll32.exe	27
PID 1380 wrote to memory of 1672	1380	rundll32.exe	27
PID 1380 wrote to memory of 1672	1380	rundll32.exe	27
PID 1380 wrote to memory of 1672	1380	rundll32.exe	27
PID 1380 wrote to memory of 1672	1380	rundll32.exe	27
PID 1380 wrote to memory of 1672	1380	rundll32.exe	27
PID 1380 wrote to memory of 1672	1380	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c0ddaa9841c5a12cd480a14400e8e9a4f558c22bace62264ee1cfeea7ba8bc2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c0ddaa9841c5a12cd480a14400e8e9a4f558c22bace62264ee1cfeea7ba8bc2.dll,#1
  2⤵
  PID:1672

memory/1672-55-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/1672-56-0x0000000000180000-0x000000000018E000-memory.dmp

Filesize
56KB

Download
memory/1672-60-0x0000000000180000-0x000000000018E000-memory.dmp

Filesize
56KB

Download
memory/1672-59-0x0000000000180000-0x000000000018E000-memory.dmp

Filesize
56KB

Download
memory/1672-61-0x0000000000170000-0x0000000000178000-memory.dmp

Filesize
32KB

Download
memory/1672-62-0x0000000000187000-0x000000000018D000-memory.dmp

Filesize
24KB

Download
memory/1672-63-0x0000000000181000-0x0000000000187000-memory.dmp

Filesize
24KB

Download
memory/1672-64-0x0000000000187000-0x000000000018D000-memory.dmp

Filesize
24KB

Download
memory/1672-65-0x0000000000181000-0x0000000000187000-memory.dmp

Filesize
24KB

Download