327ab7e1e865b5940d6be494d57605fec41f68c24ade391bdd2e7275e4cdc661

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 15:28

Target

327ab7e1e865b5940d6be494d57605fec41f68c24ade391bdd2e7275e4cdc661.dll
Size

16KB
MD5

81ee7d136be30746790d21e41a52a820
SHA1

6d116621ebbaf1116af9298d47236d36554910d8
SHA256

327ab7e1e865b5940d6be494d57605fec41f68c24ade391bdd2e7275e4cdc661
SHA512

6c2eb9503b9b56f4a7159b1b5bd152a93087a6cbe03fdcc178db66a1b12fbb3fc5562d6f5baec7f8939c1ec5a5878ffc74c953faa738ee07a38e8dd37b81fb3d
SSDEEP

384:Eg/9m7f9OzuPlMco4F5hAK8gAEOK4/vGzpSAp7:KfAzBco0TAK8dEVSvGzzF

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1964-56-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1964-57-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1964	1324	rundll32.exe	28
PID 1324 wrote to memory of 1964	1324	rundll32.exe	28
PID 1324 wrote to memory of 1964	1324	rundll32.exe	28
PID 1324 wrote to memory of 1964	1324	rundll32.exe	28
PID 1324 wrote to memory of 1964	1324	rundll32.exe	28
PID 1324 wrote to memory of 1964	1324	rundll32.exe	28
PID 1324 wrote to memory of 1964	1324	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\327ab7e1e865b5940d6be494d57605fec41f68c24ade391bdd2e7275e4cdc661.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\327ab7e1e865b5940d6be494d57605fec41f68c24ade391bdd2e7275e4cdc661.dll,#1
  2⤵
  PID:1964

memory/1964-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/1964-56-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1964-57-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download