d733e844097dbed20c4fdd6efcf68f338259c0012a55b69e604e6157a1f13ba6

Analysis

max time kernel
36s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 21:02

Target

d733e844097dbed20c4fdd6efcf68f338259c0012a55b69e604e6157a1f13ba6.dll
Size

16KB
MD5

a12d3e28dd45b6efd5f383e183da4624
SHA1

3fb71d8c6f59cd5e08f0e0aeb31faca3b9f48d6e
SHA256

d733e844097dbed20c4fdd6efcf68f338259c0012a55b69e604e6157a1f13ba6
SHA512

c9d68b84599b6ccf22759aa43b4dc5d4e9c2642701e2709617585b611be16ef2b1e912c0ba1fc29fcca17319e34574d03b6f676fa87c0c18dd289c11b0911dd3
SSDEEP

384:Eg/9m7f9OzuPlMco4F5hAK8gAEOK4/vGzpSApv:KfAzBco0TAK8dEVSvGzz5

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1772-56-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1772-57-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1772	1720	rundll32.exe	26
PID 1720 wrote to memory of 1772	1720	rundll32.exe	26
PID 1720 wrote to memory of 1772	1720	rundll32.exe	26
PID 1720 wrote to memory of 1772	1720	rundll32.exe	26
PID 1720 wrote to memory of 1772	1720	rundll32.exe	26
PID 1720 wrote to memory of 1772	1720	rundll32.exe	26
PID 1720 wrote to memory of 1772	1720	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d733e844097dbed20c4fdd6efcf68f338259c0012a55b69e604e6157a1f13ba6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d733e844097dbed20c4fdd6efcf68f338259c0012a55b69e604e6157a1f13ba6.dll,#1
  2⤵
  PID:1772

memory/1772-55-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

Filesize
8KB

Download
memory/1772-56-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1772-57-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download