89dd6176c382f43c3c081bd7accd3843026d4cdb158f2f0c809c07d97064b0b2

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 04:49

Target

89dd6176c382f43c3c081bd7accd3843026d4cdb158f2f0c809c07d97064b0b2.dll
Size

4KB
MD5

e466bc6e3ebbe7786d67ab023b074800
SHA1

85d6b6e91bf2703cd31191bff0c11e2f4e392fa0
SHA256

89dd6176c382f43c3c081bd7accd3843026d4cdb158f2f0c809c07d97064b0b2
SHA512

c7b35472c3514653bb511d3eb987c25c7ce83cfbc525e6dbc1404d2603367c17a6e74b9a608cb7b9374a78e9da166e201c18654a5d3924bb132822d964814d9e
SSDEEP

48:a5zuMqBcq06phM/wwWLSeJY8JTa6Il+L4+yIUW/eIocxOZoKURBNZJNFfHF:TRphMzf86IUaOefHF

Score

9^/10

upx

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/memory/548-57-0x00000000746B0000-0x00000000746B8000-memory.dmp	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/548-57-0x00000000746B0000-0x00000000746B8000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 548	1148	rundll32.exe	27
PID 1148 wrote to memory of 548	1148	rundll32.exe	27
PID 1148 wrote to memory of 548	1148	rundll32.exe	27
PID 1148 wrote to memory of 548	1148	rundll32.exe	27
PID 1148 wrote to memory of 548	1148	rundll32.exe	27
PID 1148 wrote to memory of 548	1148	rundll32.exe	27
PID 1148 wrote to memory of 548	1148	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\89dd6176c382f43c3c081bd7accd3843026d4cdb158f2f0c809c07d97064b0b2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\89dd6176c382f43c3c081bd7accd3843026d4cdb158f2f0c809c07d97064b0b2.dll,#1
  2⤵
  PID:548

memory/548-55-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download
memory/548-56-0x00000000746C0000-0x00000000746C8000-memory.dmp

Filesize
32KB

Download
memory/548-57-0x00000000746B0000-0x00000000746B8000-memory.dmp

Filesize
32KB

Download
memory/548-58-0x00000000746C0000-0x00000000746C8000-memory.dmp

Filesize
32KB

Download