865b87750facf22d828a806f818a0e04e8bfbeee76e2d293fc1f10e98256216e

Analysis

max time kernel
233s
max time network
332s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 06:25

Target

865b87750facf22d828a806f818a0e04e8bfbeee76e2d293fc1f10e98256216e.dll
Size

128KB
MD5

da4baa0d54af3b1f9949abaf8e77bfee
SHA1

4b984a692ab4928ba688ccb91b88c0128d78359d
SHA256

865b87750facf22d828a806f818a0e04e8bfbeee76e2d293fc1f10e98256216e
SHA512

e6eea5bcae4aaaac4f4638c3b0df627b1b516cc15eecb15ca4adcfe8fcf0792ab3fd3f3fce33abc4cb44b892556a448fe087cd83f611782b1c9494d42064b467
SSDEEP

3072:G+mLaSu3kPQ4EBd6vTerdId4XD7Tt74VrwuVtCOt8bFik:G+yUU44gdiTeidC7574VrhVAOtsFik

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1352-56-0x00000000000C0000-0x00000000000CE000-memory.dmp	upx
behavioral1/memory/1352-59-0x00000000000C0000-0x00000000000CE000-memory.dmp	upx
behavioral1/memory/1352-60-0x00000000000C0000-0x00000000000CE000-memory.dmp	upx

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Upstreezing Gain: InBuf	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 524 wrote to memory of 1352	524	rundll32.exe	28
PID 524 wrote to memory of 1352	524	rundll32.exe	28
PID 524 wrote to memory of 1352	524	rundll32.exe	28
PID 524 wrote to memory of 1352	524	rundll32.exe	28
PID 524 wrote to memory of 1352	524	rundll32.exe	28
PID 524 wrote to memory of 1352	524	rundll32.exe	28
PID 524 wrote to memory of 1352	524	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\865b87750facf22d828a806f818a0e04e8bfbeee76e2d293fc1f10e98256216e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\865b87750facf22d828a806f818a0e04e8bfbeee76e2d293fc1f10e98256216e.dll,#1
  2⤵
  - NTFS ADS
  PID:1352

memory/1352-55-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/1352-56-0x00000000000C0000-0x00000000000CE000-memory.dmp

Filesize
56KB

Download
memory/1352-59-0x00000000000C0000-0x00000000000CE000-memory.dmp

Filesize
56KB

Download
memory/1352-60-0x00000000000C0000-0x00000000000CE000-memory.dmp

Filesize
56KB

Download
memory/1352-61-0x00000000000B0000-0x00000000000B8000-memory.dmp

Filesize
32KB

Download
memory/1352-62-0x00000000000C7000-0x00000000000CD000-memory.dmp

Filesize
24KB

Download
memory/1352-63-0x00000000000C1000-0x00000000000C7000-memory.dmp

Filesize
24KB

Download