f5e8de57c692aa7772beec3e5855a27942a9580c525fc0109b894eb2258ea0ce

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 18:27

Target

f5e8de57c692aa7772beec3e5855a27942a9580c525fc0109b894eb2258ea0ce.dll
Size

144KB
MD5

a3b60fb6ac07f37ba679f54bdc2d476a
SHA1

4584889bed1b9566770fae455353695c36de5788
SHA256

f5e8de57c692aa7772beec3e5855a27942a9580c525fc0109b894eb2258ea0ce
SHA512

45af1809f8216be77f3f8dfa156b11574ea5f968138626b17cde92e92827790691a2f9a903ea39e7402c6ef4cbfbe4e984002d071327641956d62ca0e715a176
SSDEEP

3072:UOCf2ESNOLD0n0qobm6quqS1U5de8oQH+m5cD6B3tKpBBS8awz04:Ucg3098Lh1Qeh3rS8a3

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1128-56-0x0000000000130000-0x000000000013E000-memory.dmp	upx
behavioral1/memory/1128-59-0x0000000000130000-0x000000000013E000-memory.dmp	upx
behavioral1/memory/1128-60-0x0000000000130000-0x000000000013E000-memory.dmp	upx

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Half-Dupler: -%d.%d offlical privent Filed	rundll32.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\MSG_RegistCallDriveSeqPend Err: bugMask	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1128	2032	rundll32.exe	26
PID 2032 wrote to memory of 1128	2032	rundll32.exe	26
PID 2032 wrote to memory of 1128	2032	rundll32.exe	26
PID 2032 wrote to memory of 1128	2032	rundll32.exe	26
PID 2032 wrote to memory of 1128	2032	rundll32.exe	26
PID 2032 wrote to memory of 1128	2032	rundll32.exe	26
PID 2032 wrote to memory of 1128	2032	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f5e8de57c692aa7772beec3e5855a27942a9580c525fc0109b894eb2258ea0ce.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f5e8de57c692aa7772beec3e5855a27942a9580c525fc0109b894eb2258ea0ce.dll,#1
  2⤵
  - NTFS ADS
  PID:1128

memory/1128-55-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download
memory/1128-56-0x0000000000130000-0x000000000013E000-memory.dmp

Filesize
56KB

Download
memory/1128-59-0x0000000000130000-0x000000000013E000-memory.dmp

Filesize
56KB

Download
memory/1128-60-0x0000000000130000-0x000000000013E000-memory.dmp

Filesize
56KB

Download
memory/1128-61-0x0000000000120000-0x0000000000128000-memory.dmp

Filesize
32KB

Download
memory/1128-62-0x0000000000137000-0x000000000013D000-memory.dmp

Filesize
24KB

Download
memory/1128-63-0x0000000000131000-0x0000000000137000-memory.dmp

Filesize
24KB

Download