d48e173b8e355396e3281ec48ad042c4521c4bf6598f0351902abbc1e9e8be9c

Analysis

max time kernel
14s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 10:52

Target

d48e173b8e355396e3281ec48ad042c4521c4bf6598f0351902abbc1e9e8be9c.dll
Size

278KB
MD5

baeaee3788751ec3226ed493b62c0248
SHA1

627fd2a934a5033054abdf5c369e924e74e4e0fc
SHA256

d48e173b8e355396e3281ec48ad042c4521c4bf6598f0351902abbc1e9e8be9c
SHA512

3b4ffd1202ce6a538780b9aff326e41ed06e587faa6aeff1c0fcf844a45585663915d9bfba81fc32aa897585dd4f7ce36191a70212abe5327c31db38e6a74d58
SSDEEP

6144:jVtI4Z1swSSImicdcByPY132zR5DOD7eBhQQ5IVmthnb/d+oEPDE9Z:ptICstIiCY13sDODeQZC+5E9

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/952-56-0x0000000010000000-0x00000000100DB000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 8 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 952	968	rundll32.exe	28
PID 968 wrote to memory of 952	968	rundll32.exe	28
PID 968 wrote to memory of 952	968	rundll32.exe	28
PID 968 wrote to memory of 952	968	rundll32.exe	28
PID 968 wrote to memory of 952	968	rundll32.exe	28
PID 968 wrote to memory of 952	968	rundll32.exe	28
PID 968 wrote to memory of 952	968	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d48e173b8e355396e3281ec48ad042c4521c4bf6598f0351902abbc1e9e8be9c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d48e173b8e355396e3281ec48ad042c4521c4bf6598f0351902abbc1e9e8be9c.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:952

memory/952-55-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download
memory/952-56-0x0000000010000000-0x00000000100DB000-memory.dmp

Filesize
876KB

Download