7ba60f17d34de4abd4334f04ad3ed49a1650a458df7d6809632f01f6864520f6

Analysis

max time kernel
17s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 19:51

Target

7ba60f17d34de4abd4334f04ad3ed49a1650a458df7d6809632f01f6864520f6.dll
Size

140KB
MD5

bd74119fcc8f713836d0f282bf796ac2
SHA1

6a32579f4fdaabd595d46378032300803080d151
SHA256

7ba60f17d34de4abd4334f04ad3ed49a1650a458df7d6809632f01f6864520f6
SHA512

6999c3944613fe6ffc1c555ee8da739971cc8a5981d6f9c5d5342a6e4573dc0526f05f6b96905a7226663c88d5c35aa041d8e60077e9352b14bd335fdab35fcc
SSDEEP

3072:g8eadFskM+6Y5sWyfL6Q1V5Ifm88lCv3YD8UdJSTfF1:g8FFsb+Jdw+Q13im8cJK

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/968-56-0x0000000000200000-0x000000000020D000-memory.dmp	upx
behavioral1/memory/968-60-0x0000000000200000-0x000000000020D000-memory.dmp	upx
behavioral1/memory/968-59-0x0000000000200000-0x000000000020D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 968	1728	rundll32.exe	28
PID 1728 wrote to memory of 968	1728	rundll32.exe	28
PID 1728 wrote to memory of 968	1728	rundll32.exe	28
PID 1728 wrote to memory of 968	1728	rundll32.exe	28
PID 1728 wrote to memory of 968	1728	rundll32.exe	28
PID 1728 wrote to memory of 968	1728	rundll32.exe	28
PID 1728 wrote to memory of 968	1728	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ba60f17d34de4abd4334f04ad3ed49a1650a458df7d6809632f01f6864520f6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ba60f17d34de4abd4334f04ad3ed49a1650a458df7d6809632f01f6864520f6.dll,#1
  2⤵
  PID:968

memory/968-55-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download
memory/968-56-0x0000000000200000-0x000000000020D000-memory.dmp

Filesize
52KB

Download
memory/968-60-0x0000000000200000-0x000000000020D000-memory.dmp

Filesize
52KB

Download
memory/968-59-0x0000000000200000-0x000000000020D000-memory.dmp

Filesize
52KB

Download
memory/968-61-0x0000000000206000-0x000000000020C000-memory.dmp

Filesize
24KB

Download
memory/968-62-0x0000000000201000-0x0000000000206000-memory.dmp

Filesize
20KB

Download