b0c4c11c72cb42eab90c14399c02d9b3f24a4375d737fee2ebd3ac9380c3d9d5

Analysis

max time kernel
41s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 20:13

Target

b0c4c11c72cb42eab90c14399c02d9b3f24a4375d737fee2ebd3ac9380c3d9d5.dll
Size

91KB
MD5

25a562cfbcb91ed3a3257a28f427a253
SHA1

4e509b036b04871156fbc90dc4772e53a73008dc
SHA256

b0c4c11c72cb42eab90c14399c02d9b3f24a4375d737fee2ebd3ac9380c3d9d5
SHA512

4b486bd01a44335af30e549647a497f87ee4acd721ff28cd63be411aa63a4965bacea5ba2434e09b542092666633718c3bee71783573c359d752395b202cef70
SSDEEP

1536:Nh1fL15Vx2G5bCgsSeUzRHGId+K4ml34qNopY67oUcN:Nh53p5NIe0WFopYhfN

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1156-56-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 1156	616	rundll32.exe	28
PID 616 wrote to memory of 1156	616	rundll32.exe	28
PID 616 wrote to memory of 1156	616	rundll32.exe	28
PID 616 wrote to memory of 1156	616	rundll32.exe	28
PID 616 wrote to memory of 1156	616	rundll32.exe	28
PID 616 wrote to memory of 1156	616	rundll32.exe	28
PID 616 wrote to memory of 1156	616	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0c4c11c72cb42eab90c14399c02d9b3f24a4375d737fee2ebd3ac9380c3d9d5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0c4c11c72cb42eab90c14399c02d9b3f24a4375d737fee2ebd3ac9380c3d9d5.dll,#1
  2⤵
  PID:1156

memory/1156-55-0x0000000075BE1000-0x0000000075BE3000-memory.dmp

Filesize
8KB

Download
memory/1156-56-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download