7a948e3c1f98692cf0260e70a5bf821ced378eeaf28ee299f38af1cd97064964

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 06:15

Target

7a948e3c1f98692cf0260e70a5bf821ced378eeaf28ee299f38af1cd97064964.dll
Size

16KB
MD5

26e3079e7a4e46351d21e54106765b40
SHA1

71aaf533682e40394d82f5a7fc900e1db9292dc9
SHA256

7a948e3c1f98692cf0260e70a5bf821ced378eeaf28ee299f38af1cd97064964
SHA512

61c2d994ce3b325072444dd868c5474d233437e31814d0c22c414074c8176242992376e91ca33120e48485bed493302dd04c720a0db36fa59c43b3e36a9cf3ed
SSDEEP

384:Eg/9m7f9OzuPlMco4F5hAK8gAEOK4/vGzpSAp6:KfAzBco0TAK8dEVSvGzzM

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/992-56-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 240 wrote to memory of 992	240	rundll32.exe	28
PID 240 wrote to memory of 992	240	rundll32.exe	28
PID 240 wrote to memory of 992	240	rundll32.exe	28
PID 240 wrote to memory of 992	240	rundll32.exe	28
PID 240 wrote to memory of 992	240	rundll32.exe	28
PID 240 wrote to memory of 992	240	rundll32.exe	28
PID 240 wrote to memory of 992	240	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a948e3c1f98692cf0260e70a5bf821ced378eeaf28ee299f38af1cd97064964.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a948e3c1f98692cf0260e70a5bf821ced378eeaf28ee299f38af1cd97064964.dll,#1
  2⤵
  PID:992

memory/992-55-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/992-56-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download