69f9f26f0c1995d706b0a5f29dc480b56660e91f9bb049045f54187ef01617fd

Analysis

max time kernel
44s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 10:52

Target

69f9f26f0c1995d706b0a5f29dc480b56660e91f9bb049045f54187ef01617fd.dll
Size

141KB
MD5

3b1c5ffc45a703a7081d17ab57846c80
SHA1

4417b320106a138cfe8660c7d31a901e326fb535
SHA256

69f9f26f0c1995d706b0a5f29dc480b56660e91f9bb049045f54187ef01617fd
SHA512

49d0f8d4813525609c8060a2c7e1a470f026cc944414990049d925421188059306cbfc07233183919fa42e29141b2ceea4f9bbfe017bf4422248e27028f67e28
SSDEEP

1536:VOzMIXh3CrmyOrRFoRKD5UP0YSSz0K+SKZ9kdF0P6fFSa+rdWigqksTGnDgSG+3:VEFh3PyOrRqRlP0K+XZ9gRUksCnsE3

Score

8^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
976	rundll32mgr.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00140000000054ab-56.dat	upx
behavioral1/files/0x00140000000054ab-57.dat	upx
behavioral1/files/0x00140000000054ab-59.dat	upx
behavioral1/memory/976-60-0x0000000000400000-0x0000000000462000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
1652	rundll32.exe
1652	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 1652	1084	rundll32.exe	27
PID 1084 wrote to memory of 1652	1084	rundll32.exe	27
PID 1084 wrote to memory of 1652	1084	rundll32.exe	27
PID 1084 wrote to memory of 1652	1084	rundll32.exe	27
PID 1084 wrote to memory of 1652	1084	rundll32.exe	27
PID 1084 wrote to memory of 1652	1084	rundll32.exe	27
PID 1084 wrote to memory of 1652	1084	rundll32.exe	27
PID 1652 wrote to memory of 976	1652	rundll32.exe	28
PID 1652 wrote to memory of 976	1652	rundll32.exe	28
PID 1652 wrote to memory of 976	1652	rundll32.exe	28
PID 1652 wrote to memory of 976	1652	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\69f9f26f0c1995d706b0a5f29dc480b56660e91f9bb049045f54187ef01617fd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\69f9f26f0c1995d706b0a5f29dc480b56660e91f9bb049045f54187ef01617fd.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    PID:976

C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
132KB

MD5
cbd38d234814dc2b368a90a57e0b8ec1

SHA1
648ea0a1598ab0c1d91e1f45157b5ca6a6bc1dc4

SHA256
f761a2068bfd80d7bb1e9ccd6cca47be2952fa641b85494cbabbd336d4f2d786

SHA512
7866a0c6b7bcc272428062e744873a4457a5519a5731e377ecc661e76051bb5078b8c04c804816c847dc4964033893bea7f6815b9febb26f8d00a20157a0bab2

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
132KB

MD5
cbd38d234814dc2b368a90a57e0b8ec1

SHA1
648ea0a1598ab0c1d91e1f45157b5ca6a6bc1dc4

SHA256
f761a2068bfd80d7bb1e9ccd6cca47be2952fa641b85494cbabbd336d4f2d786

SHA512
7866a0c6b7bcc272428062e744873a4457a5519a5731e377ecc661e76051bb5078b8c04c804816c847dc4964033893bea7f6815b9febb26f8d00a20157a0bab2

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
132KB

MD5
cbd38d234814dc2b368a90a57e0b8ec1

SHA1
648ea0a1598ab0c1d91e1f45157b5ca6a6bc1dc4

SHA256
f761a2068bfd80d7bb1e9ccd6cca47be2952fa641b85494cbabbd336d4f2d786

SHA512
7866a0c6b7bcc272428062e744873a4457a5519a5731e377ecc661e76051bb5078b8c04c804816c847dc4964033893bea7f6815b9febb26f8d00a20157a0bab2

Download Submit
memory/976-60-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1652-55-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download