3ec3ba2d09eef260ff2fd54f586f128ec8b5905e8b236f619985f4a3229a53a3

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 12:34

Target

3ec3ba2d09eef260ff2fd54f586f128ec8b5905e8b236f619985f4a3229a53a3.dll
Size

179KB
MD5

5b05d6a5de62941fabe5358dca1b3fb8
SHA1

6243d98b68a5e7084f6347318626df5c8f7a74c0
SHA256

3ec3ba2d09eef260ff2fd54f586f128ec8b5905e8b236f619985f4a3229a53a3
SHA512

ef8f7b4add6633ee039ae2f2790871b334a7972c5e8473bbcef2f97b112f93cec4e34e30a73b8dc97e75fd8ff8d1787f189166eb2db376d545641981dbd35fd4
SSDEEP

3072:MqgnIfNxkQXnpaWF/Gn+FHZQXEGukhrEmLQhwHvwdG5WOX0AradQhH6CPqb2sGb:Mqxlpaz+FH+0GuqAEQKPAGNFK+CKs0

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1656-56-0x0000000000190000-0x0000000000209000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1656	1620	rundll32.exe	28
PID 1620 wrote to memory of 1656	1620	rundll32.exe	28
PID 1620 wrote to memory of 1656	1620	rundll32.exe	28
PID 1620 wrote to memory of 1656	1620	rundll32.exe	28
PID 1620 wrote to memory of 1656	1620	rundll32.exe	28
PID 1620 wrote to memory of 1656	1620	rundll32.exe	28
PID 1620 wrote to memory of 1656	1620	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ec3ba2d09eef260ff2fd54f586f128ec8b5905e8b236f619985f4a3229a53a3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ec3ba2d09eef260ff2fd54f586f128ec8b5905e8b236f619985f4a3229a53a3.dll,#1
  2⤵
  PID:1656

memory/1656-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1656-56-0x0000000000190000-0x0000000000209000-memory.dmp

Filesize
484KB

Download