3381d6286a7de089d68889f6ffea7e244f7b1ce9052537a61980d97d6dc090d9

Analysis

max time kernel
7s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 14:38

Target

3381d6286a7de089d68889f6ffea7e244f7b1ce9052537a61980d97d6dc090d9.dll
Size

120KB
MD5

29e48e66306a2fda94a7223736bf1067
SHA1

e962464850a80c2095ee9e780e2d427a8f5f12eb
SHA256

3381d6286a7de089d68889f6ffea7e244f7b1ce9052537a61980d97d6dc090d9
SHA512

00fa18335a57cf8e73f835c633ec7f949268d5d2095ee9a6b0dcd6c78e8c021c77c33d05cfdcef5aac76237b6accf58d16717b215e4976d947ce7a1bffe16ea3
SSDEEP

3072:p1F2q93tDB+8Uob+1WeCHjP2rTpavx19url5LqqtnL0:p10q93tllUob+sDVvuPXtnL0

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/2016-56-0x00000000001B0000-0x00000000001BE000-memory.dmp	upx
behavioral1/memory/2016-60-0x00000000001B0000-0x00000000001BE000-memory.dmp	upx
behavioral1/memory/2016-59-0x00000000001B0000-0x00000000001BE000-memory.dmp	upx

NTFS ADS 2 IoCs

Processes:

rundll32.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Giversion: %d dB	rundll32.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\0x09 - anterface - DataPump - cannot Succes because to Tx Signormat: %d)	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 976 wrote to memory of 2016	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 2016	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 2016	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 2016	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 2016	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 2016	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 2016	976	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3381d6286a7de089d68889f6ffea7e244f7b1ce9052537a61980d97d6dc090d9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:976

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3381d6286a7de089d68889f6ffea7e244f7b1ce9052537a61980d97d6dc090d9.dll,#1
2⤵
- NTFS ADS
PID:2016

memory/2016-54-0x0000000000000000-mapping.dmp

Download
memory/2016-55-0x0000000075891000-0x0000000075893000-memory.dmp

Filesize
8KB

Download
memory/2016-56-0x00000000001B0000-0x00000000001BE000-memory.dmp

Filesize
56KB

Download
memory/2016-60-0x00000000001B0000-0x00000000001BE000-memory.dmp

Filesize
56KB

Download
memory/2016-59-0x00000000001B0000-0x00000000001BE000-memory.dmp

Filesize
56KB

Download
memory/2016-61-0x0000000000160000-0x0000000000168000-memory.dmp

Filesize
32KB

Download
memory/2016-62-0x00000000001B7000-0x00000000001BD000-memory.dmp

Filesize
24KB

Download
memory/2016-63-0x00000000001B1000-0x00000000001B7000-memory.dmp

Filesize
24KB

Download