a4334e8df7a184c8d6bca708ff3467a5b16ed9015c109bb36d35e9c53779813b

Analysis

max time kernel
41s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 04:05

Target

a4334e8df7a184c8d6bca708ff3467a5b16ed9015c109bb36d35e9c53779813b.dll
Size

106KB
MD5

a1e7a5cecd58d9fb4f4e1a0c3ebe1c9c
SHA1

f78b9a04bda6b6ae6deb6b8e820d315f284c863c
SHA256

a4334e8df7a184c8d6bca708ff3467a5b16ed9015c109bb36d35e9c53779813b
SHA512

2ffb17e322e75cc578f1ffb41cf6f9e65de2bc9322c845678f87f1951da441b49457921e9ad38a579a1c0bb2bd0b1f7c6ef0471bb3b1fa6bb292d40c055ac502
SSDEEP

1536:1d8T7zRNkvlQJmRaKmQhdhK26U/vJ373dxEwvVIps5wylA4Tc5iIejvIDyTI:123FNkveJ/6Lq87L5E0T6UUDys

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2000-56-0x0000000075250000-0x000000007527E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 2000	1696	rundll32.exe	28
PID 1696 wrote to memory of 2000	1696	rundll32.exe	28
PID 1696 wrote to memory of 2000	1696	rundll32.exe	28
PID 1696 wrote to memory of 2000	1696	rundll32.exe	28
PID 1696 wrote to memory of 2000	1696	rundll32.exe	28
PID 1696 wrote to memory of 2000	1696	rundll32.exe	28
PID 1696 wrote to memory of 2000	1696	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4334e8df7a184c8d6bca708ff3467a5b16ed9015c109bb36d35e9c53779813b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4334e8df7a184c8d6bca708ff3467a5b16ed9015c109bb36d35e9c53779813b.dll,#1
  2⤵
  PID:2000

memory/2000-55-0x0000000076941000-0x0000000076943000-memory.dmp

Filesize
8KB

Download
memory/2000-56-0x0000000075250000-0x000000007527E000-memory.dmp

Filesize
184KB

Download