ad52be528cebed4539177995462607905d8f8f93d3723c7641432e33cba86b9c

Analysis

max time kernel
227s
max time network
337s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:24

Target

ad52be528cebed4539177995462607905d8f8f93d3723c7641432e33cba86b9c.dll
Size

92KB
MD5

b2443eec9ed7cbbb7fa9400d4f617e39
SHA1

5f3daf5606544f7aab4362279f946abf3f517fac
SHA256

ad52be528cebed4539177995462607905d8f8f93d3723c7641432e33cba86b9c
SHA512

9aaa126c04b16f92c8259c273a864b1b77b97647252155754ce701bda247105c197173e4d84909d482948551dfeed0cb6a530a783b0708cfa122120653742eda
SSDEEP

1536:akTMaAumGS+/IusNmGyu5PR8swNdQAOVghI/MY+SO6pmUWgBb8lQJ:akzhmGb/Iukvyu5JBwHnPhI0Y+SkgBq+

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/988-56-0x0000000000150000-0x000000000015E000-memory.dmp	upx
behavioral1/memory/988-59-0x0000000000150000-0x000000000015E000-memory.dmp	upx
behavioral1/memory/988-60-0x0000000000150000-0x000000000015E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 612 wrote to memory of 988	612	rundll32.exe	rundll32.exe
PID 612 wrote to memory of 988	612	rundll32.exe	rundll32.exe
PID 612 wrote to memory of 988	612	rundll32.exe	rundll32.exe
PID 612 wrote to memory of 988	612	rundll32.exe	rundll32.exe
PID 612 wrote to memory of 988	612	rundll32.exe	rundll32.exe
PID 612 wrote to memory of 988	612	rundll32.exe	rundll32.exe
PID 612 wrote to memory of 988	612	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad52be528cebed4539177995462607905d8f8f93d3723c7641432e33cba86b9c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:612

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad52be528cebed4539177995462607905d8f8f93d3723c7641432e33cba86b9c.dll,#1
2⤵
PID:988

memory/988-54-0x0000000000000000-mapping.dmp

Download
memory/988-55-0x00000000767C1000-0x00000000767C3000-memory.dmp

Filesize
8KB

Download
memory/988-56-0x0000000000150000-0x000000000015E000-memory.dmp

Filesize
56KB

Download
memory/988-59-0x0000000000150000-0x000000000015E000-memory.dmp

Filesize
56KB

Download
memory/988-60-0x0000000000150000-0x000000000015E000-memory.dmp

Filesize
56KB

Download
memory/988-61-0x0000000000140000-0x0000000000148000-memory.dmp

Filesize
32KB

Download
memory/988-62-0x0000000000157000-0x000000000015D000-memory.dmp

Filesize
24KB

Download
memory/988-63-0x0000000000151000-0x0000000000157000-memory.dmp

Filesize
24KB

Download
memory/988-64-0x0000000000157000-0x000000000015D000-memory.dmp

Filesize
24KB

Download
memory/988-65-0x0000000000151000-0x0000000000157000-memory.dmp

Filesize
24KB

Download