8be71a4f79a28e9120319f47ef41f86b82f28d6c3510287e1b8382e37d02264b

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 00:53

Target

8be71a4f79a28e9120319f47ef41f86b82f28d6c3510287e1b8382e37d02264b.dll
Size

67KB
MD5

10bdc155269e6c504a0bfdd7adb8a58f
SHA1

528172190e9d1e4e03e44858fd62618322a0b079
SHA256

8be71a4f79a28e9120319f47ef41f86b82f28d6c3510287e1b8382e37d02264b
SHA512

1019acad2147a686b169adaf0a0a17b885bae3896197f318575a19aada4eda208b71f4f9896869e8432b5842883464a699f0cb55cf820c3a35e4d0387d4b57e0
SSDEEP

1536:7nrxDussGn4AAejPC7Mp/c+HJgKKWz3p/wBBwC:D6tV0pk+pg6t/EKC

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1460-56-0x0000000000400000-0x0000000000431000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1460	2044	rundll32.exe	26
PID 2044 wrote to memory of 1460	2044	rundll32.exe	26
PID 2044 wrote to memory of 1460	2044	rundll32.exe	26
PID 2044 wrote to memory of 1460	2044	rundll32.exe	26
PID 2044 wrote to memory of 1460	2044	rundll32.exe	26
PID 2044 wrote to memory of 1460	2044	rundll32.exe	26
PID 2044 wrote to memory of 1460	2044	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8be71a4f79a28e9120319f47ef41f86b82f28d6c3510287e1b8382e37d02264b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8be71a4f79a28e9120319f47ef41f86b82f28d6c3510287e1b8382e37d02264b.dll,#1
  2⤵
  PID:1460

memory/1460-55-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download
memory/1460-56-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download