26b863791baa89e89be037ce5d90a9dc4a14412e102ccc8e1d22838ca2f149dd

Analysis

max time kernel
35s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 00:29

Target

26b863791baa89e89be037ce5d90a9dc4a14412e102ccc8e1d22838ca2f149dd.dll
Size

230KB
MD5

b949cc7855916d31686c5d3428ae04cb
SHA1

22abcbd317c32853d3d6008cddf23177a75f4855
SHA256

26b863791baa89e89be037ce5d90a9dc4a14412e102ccc8e1d22838ca2f149dd
SHA512

255a5f818d4a973d37d12bd1624b52bfca3d559a41c0a2b83e7053d494897dd730b743a75cd54957e54c8c1be977d73f68968b9f44e27cfe413a31a58ae61e39
SSDEEP

6144:bSkyR07ioFXP8eubYknnB7TwOIHbeb1oU:bSky8zF/8euUUnhT7IHCbe

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/532-56-0x0000000010000000-0x0000000010088000-memory.dmp	upx
behavioral1/memory/532-57-0x0000000010000000-0x0000000010088000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
532	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 532	1452	rundll32.exe	26
PID 1452 wrote to memory of 532	1452	rundll32.exe	26
PID 1452 wrote to memory of 532	1452	rundll32.exe	26
PID 1452 wrote to memory of 532	1452	rundll32.exe	26
PID 1452 wrote to memory of 532	1452	rundll32.exe	26
PID 1452 wrote to memory of 532	1452	rundll32.exe	26
PID 1452 wrote to memory of 532	1452	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\26b863791baa89e89be037ce5d90a9dc4a14412e102ccc8e1d22838ca2f149dd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\26b863791baa89e89be037ce5d90a9dc4a14412e102ccc8e1d22838ca2f149dd.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:532

memory/532-55-0x0000000075041000-0x0000000075043000-memory.dmp

Filesize
8KB

Download
memory/532-56-0x0000000010000000-0x0000000010088000-memory.dmp

Filesize
544KB

Download
memory/532-57-0x0000000010000000-0x0000000010088000-memory.dmp

Filesize
544KB

Download