228693f1f84301f09af0362fb23c1ae5b6b5016500198829df259c60083bc7de

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 09:30

Target

228693f1f84301f09af0362fb23c1ae5b6b5016500198829df259c60083bc7de.dll
Size

78KB
MD5

29f4319c96235aacd80a38dff0958f30
SHA1

a2441be3a757c0ca60b534aaf52d41a2641e270b
SHA256

228693f1f84301f09af0362fb23c1ae5b6b5016500198829df259c60083bc7de
SHA512

3f727aa656b7cae1630b4d8f03dc1dc86019d44a00d383889c3939c2d084058fac96e9f842c739a9b6688977f7f355150763e8176ad0631e220c23dd97c79550
SSDEEP

1536:mc1Opqw0vQfF17jn2hACQGw3OTZekyVojJbHQbQeoGvq:zspTfFXNGKNVojJbHvMy

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1456-56-0x0000000010000000-0x000000001001A000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\228693f1f84301f09af0362fb23c1ae5b6b5016500198829df259c60083bc7de.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\228693f1f84301f09af0362fb23c1ae5b6b5016500198829df259c60083bc7de.dll,#1
  2⤵
  PID:1456

memory/1456-54-0x0000000000000000-mapping.dmp

Download
memory/1456-55-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download
memory/1456-56-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download