333fa9097f160adb348c2869d46316dab27dcc5b42a7287d93e201496c835140

Analysis

max time kernel
45s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-10-2022 04:40

Target

333fa9097f160adb348c2869d46316dab27dcc5b42a7287d93e201496c835140.dll
Size

15KB
MD5

84070879c45c40135f670ee8bb0d4eb8
SHA1

2885eda5b12ee763409045d918e2904d4e17af67
SHA256

333fa9097f160adb348c2869d46316dab27dcc5b42a7287d93e201496c835140
SHA512

07f4b11da870bd0922051a9150aead1c2227b60c9ff049f2dc0723b1984cfdfb86abeb66123f0bc9c9d726a1583683b119ace3428c2d75f0fb15fe27d053ff06
SSDEEP

384:wpZUxKjQXjp5xfWxoVT1d23SvQnYUqtdg/gs+s:2/QTpXuxoVJd2ioPqD8B

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1908-56-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 1908	940	rundll32.exe	28
PID 940 wrote to memory of 1908	940	rundll32.exe	28
PID 940 wrote to memory of 1908	940	rundll32.exe	28
PID 940 wrote to memory of 1908	940	rundll32.exe	28
PID 940 wrote to memory of 1908	940	rundll32.exe	28
PID 940 wrote to memory of 1908	940	rundll32.exe	28
PID 940 wrote to memory of 1908	940	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\333fa9097f160adb348c2869d46316dab27dcc5b42a7287d93e201496c835140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\333fa9097f160adb348c2869d46316dab27dcc5b42a7287d93e201496c835140.dll,#1
  2⤵
  PID:1908

memory/1908-54-0x0000000000000000-mapping.dmp

Download
memory/1908-55-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download
memory/1908-56-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download