577369cad8bf2236abda0260afb040513c02aa225663b58e0491a0c7c9354873

Analysis

max time kernel
245s
max time network
335s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 06:15

Target

577369cad8bf2236abda0260afb040513c02aa225663b58e0491a0c7c9354873.dll
Size

16KB
MD5

6e9452f3dfcf1f6ef4d0da7acca23b10
SHA1

9a9482e02f7bf2bb6623efd2541361acfd790231
SHA256

577369cad8bf2236abda0260afb040513c02aa225663b58e0491a0c7c9354873
SHA512

ded76aff38f23fa6bca30cf29a6a2fa949f0b90a4720a5eaf01bd4c13074b3c9ec9d8d04b51ba891384260b1035a942755786cee90ef28cce37e8b3d7ce6aef4
SSDEEP

384:Eg/9m7f9OzuPlMco4F5hAK8gAEOK4/vGzpSApX:KfAzBco0TAK8dEVSvGzz9

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/580-56-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/580-57-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 524 wrote to memory of 580	524	rundll32.exe	28
PID 524 wrote to memory of 580	524	rundll32.exe	28
PID 524 wrote to memory of 580	524	rundll32.exe	28
PID 524 wrote to memory of 580	524	rundll32.exe	28
PID 524 wrote to memory of 580	524	rundll32.exe	28
PID 524 wrote to memory of 580	524	rundll32.exe	28
PID 524 wrote to memory of 580	524	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\577369cad8bf2236abda0260afb040513c02aa225663b58e0491a0c7c9354873.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\577369cad8bf2236abda0260afb040513c02aa225663b58e0491a0c7c9354873.dll,#1
  2⤵
  PID:580

memory/580-55-0x0000000076D71000-0x0000000076D73000-memory.dmp

Filesize
8KB

Download
memory/580-56-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/580-57-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download