d36cf82ef8ac1a19b1ef27a004db398683a5206a8aee33b481751886dc1f59d7

Analysis

max time kernel
36s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 17:54

Target

d36cf82ef8ac1a19b1ef27a004db398683a5206a8aee33b481751886dc1f59d7.dll
Size

72KB
MD5

81d331adab983efefbc5042da049c748
SHA1

7ed1727431a8159077e868a062a1c9c6861176bb
SHA256

d36cf82ef8ac1a19b1ef27a004db398683a5206a8aee33b481751886dc1f59d7
SHA512

bdc8ef93236f9217e21e70140be3593b91c8ae42b40accf096e2b7e4dcf56ecb3ab78ed08777d4f5dd91ee7e92cfb62d49bfd580e910bc795a61f9e903e68251
SSDEEP

1536:NomNZnI+CQSrNHLQcKAiU+FFF+Lo6/FTcgcTrnabyu3v:NooC+CDLQRAiUKK9LcTEyu/

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1580-56-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1580	1720	rundll32.exe	27
PID 1720 wrote to memory of 1580	1720	rundll32.exe	27
PID 1720 wrote to memory of 1580	1720	rundll32.exe	27
PID 1720 wrote to memory of 1580	1720	rundll32.exe	27
PID 1720 wrote to memory of 1580	1720	rundll32.exe	27
PID 1720 wrote to memory of 1580	1720	rundll32.exe	27
PID 1720 wrote to memory of 1580	1720	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d36cf82ef8ac1a19b1ef27a004db398683a5206a8aee33b481751886dc1f59d7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d36cf82ef8ac1a19b1ef27a004db398683a5206a8aee33b481751886dc1f59d7.dll,#1
  2⤵
  PID:1580

memory/1580-55-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download
memory/1580-56-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download