72213502be1cd5438425362f8436abb606a65c97353470583bc05730b0ccb6f9

Analysis

max time kernel
27s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23/11/2022, 22:31

Target

72213502be1cd5438425362f8436abb606a65c97353470583bc05730b0ccb6f9.dll
Size

108KB
MD5

4535afc7c41da7344957fb17d2ff00f7
SHA1

63a5f9d467006d68db5f9d16a8198711b8a12944
SHA256

72213502be1cd5438425362f8436abb606a65c97353470583bc05730b0ccb6f9
SHA512

d9eeb3a8c1bfb13c8ceb487cf5b22b6fe469d29660bad991e2367898c82452e11cb839c072260138eeb6d7ee842af6d1c8be5531830ff958815aa38f5d9a7a6e
SSDEEP

3072:PXRdhEKHgnmiUbnoiYdMJdLiPKAS+xY+8/:PfhEKHkFRoAS9+8/

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1792-56-0x00000000001C0000-0x00000000001CE000-memory.dmp	upx
behavioral1/memory/1792-60-0x00000000001C0000-0x00000000001CE000-memory.dmp	upx
behavioral1/memory/1792-59-0x00000000001C0000-0x00000000001CE000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 1792	1260	rundll32.exe	28
PID 1260 wrote to memory of 1792	1260	rundll32.exe	28
PID 1260 wrote to memory of 1792	1260	rundll32.exe	28
PID 1260 wrote to memory of 1792	1260	rundll32.exe	28
PID 1260 wrote to memory of 1792	1260	rundll32.exe	28
PID 1260 wrote to memory of 1792	1260	rundll32.exe	28
PID 1260 wrote to memory of 1792	1260	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\72213502be1cd5438425362f8436abb606a65c97353470583bc05730b0ccb6f9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\72213502be1cd5438425362f8436abb606a65c97353470583bc05730b0ccb6f9.dll,#1
  2⤵
  PID:1792

memory/1792-55-0x0000000076381000-0x0000000076383000-memory.dmp

Filesize
8KB

Download
memory/1792-56-0x00000000001C0000-0x00000000001CE000-memory.dmp

Filesize
56KB

Download
memory/1792-60-0x00000000001C0000-0x00000000001CE000-memory.dmp

Filesize
56KB

Download
memory/1792-59-0x00000000001C0000-0x00000000001CE000-memory.dmp

Filesize
56KB

Download
memory/1792-61-0x00000000001B0000-0x00000000001B8000-memory.dmp

Filesize
32KB

Download
memory/1792-62-0x00000000001C7000-0x00000000001CD000-memory.dmp

Filesize
24KB

Download
memory/1792-63-0x00000000001C1000-0x00000000001C7000-memory.dmp

Filesize
24KB

Download