af451acd8c876bfd3945f134dee460f236f396c4794e1ffe1f514d930d812f08

Analysis

max time kernel
37s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:11

Target

af451acd8c876bfd3945f134dee460f236f396c4794e1ffe1f514d930d812f08.dll
Size

263KB
MD5

e7f09920ad6fda9d4640d7a6fe72e6f3
SHA1

691633f26f786f7090b0bfcbc19219c9a146e014
SHA256

af451acd8c876bfd3945f134dee460f236f396c4794e1ffe1f514d930d812f08
SHA512

a05fda3128806e402e1bd5825561f4f67301692e983145f07d530a1edf8e82485f4864c2464a2f5070847542346c083728ccc9f8997708cff73fc9b2aac9f041
SSDEEP

6144:EPtFJxLBX2aP7EKJDqahkrijCdpaaO8TRn9iEqJ8kJj8w24XVt:ED1VP7LDhkriMOEn7qjqw9

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1260-56-0x0000000001CA0000-0x0000000001D56000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1192 wrote to memory of 1260	1192	rundll32.exe	rundll32.exe
PID 1192 wrote to memory of 1260	1192	rundll32.exe	rundll32.exe
PID 1192 wrote to memory of 1260	1192	rundll32.exe	rundll32.exe
PID 1192 wrote to memory of 1260	1192	rundll32.exe	rundll32.exe
PID 1192 wrote to memory of 1260	1192	rundll32.exe	rundll32.exe
PID 1192 wrote to memory of 1260	1192	rundll32.exe	rundll32.exe
PID 1192 wrote to memory of 1260	1192	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af451acd8c876bfd3945f134dee460f236f396c4794e1ffe1f514d930d812f08.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1192

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af451acd8c876bfd3945f134dee460f236f396c4794e1ffe1f514d930d812f08.dll,#1
2⤵
PID:1260

memory/1260-54-0x0000000000000000-mapping.dmp

Download
memory/1260-55-0x0000000075591000-0x0000000075593000-memory.dmp

Filesize
8KB

Download
memory/1260-56-0x0000000001CA0000-0x0000000001D56000-memory.dmp

Filesize
728KB

Download