fac2f5f5d3d55434642084cff42072490504230c5a0dcfc834aa237b4d7e7f6f

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 12:38

Target

fac2f5f5d3d55434642084cff42072490504230c5a0dcfc834aa237b4d7e7f6f.dll
Size

196KB
MD5

6b2278fcf8b2b287aa913a11346c2d01
SHA1

ba6a6c20b815c6ccf9f50a3043e7094574fe0f32
SHA256

fac2f5f5d3d55434642084cff42072490504230c5a0dcfc834aa237b4d7e7f6f
SHA512

726ff963b2dd64b60ee06e0b30d9c8d1cd3df8416751af72f468b8007bf348df706be63e642c30b5ef2f0277ae5085214930216af2ee7ca6ca08abe8c4d058a5
SSDEEP

3072:YTLmA2ib0oU3lvczTXwdPKF3C+ZzQqihgrCQhPlxgaT9w59wflh:oL92iVvzDwlkZ0qTrCALT0slh

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1204-56-0x0000000000150000-0x000000000015E000-memory.dmp	upx
behavioral1/memory/1204-60-0x0000000000150000-0x000000000015E000-memory.dmp	upx
behavioral1/memory/1204-59-0x0000000000150000-0x000000000015E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1280 wrote to memory of 1204	1280	rundll32.exe	rundll32.exe
PID 1280 wrote to memory of 1204	1280	rundll32.exe	rundll32.exe
PID 1280 wrote to memory of 1204	1280	rundll32.exe	rundll32.exe
PID 1280 wrote to memory of 1204	1280	rundll32.exe	rundll32.exe
PID 1280 wrote to memory of 1204	1280	rundll32.exe	rundll32.exe
PID 1280 wrote to memory of 1204	1280	rundll32.exe	rundll32.exe
PID 1280 wrote to memory of 1204	1280	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fac2f5f5d3d55434642084cff42072490504230c5a0dcfc834aa237b4d7e7f6f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1280

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fac2f5f5d3d55434642084cff42072490504230c5a0dcfc834aa237b4d7e7f6f.dll,#1
2⤵
PID:1204

memory/1204-54-0x0000000000000000-mapping.dmp

Download
memory/1204-55-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1204-56-0x0000000000150000-0x000000000015E000-memory.dmp

Filesize
56KB

Download
memory/1204-60-0x0000000000150000-0x000000000015E000-memory.dmp

Filesize
56KB

Download
memory/1204-59-0x0000000000150000-0x000000000015E000-memory.dmp

Filesize
56KB

Download
memory/1204-61-0x0000000000157000-0x000000000015D000-memory.dmp

Filesize
24KB

Download
memory/1204-62-0x0000000000151000-0x0000000000157000-memory.dmp

Filesize
24KB

Download