7a948e3c1f98692cf0260e70a5bf821ced378eeaf28ee299f38af1cd97064964

Analysis

max time kernel
252s
max time network
294s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 06:15

Target

7a948e3c1f98692cf0260e70a5bf821ced378eeaf28ee299f38af1cd97064964.dll
Size

16KB
MD5

26e3079e7a4e46351d21e54106765b40
SHA1

71aaf533682e40394d82f5a7fc900e1db9292dc9
SHA256

7a948e3c1f98692cf0260e70a5bf821ced378eeaf28ee299f38af1cd97064964
SHA512

61c2d994ce3b325072444dd868c5474d233437e31814d0c22c414074c8176242992376e91ca33120e48485bed493302dd04c720a0db36fa59c43b3e36a9cf3ed
SSDEEP

384:Eg/9m7f9OzuPlMco4F5hAK8gAEOK4/vGzpSAp6:KfAzBco0TAK8dEVSvGzzM

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1432-133-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 1432	3400	rundll32.exe	82
PID 3400 wrote to memory of 1432	3400	rundll32.exe	82
PID 3400 wrote to memory of 1432	3400	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a948e3c1f98692cf0260e70a5bf821ced378eeaf28ee299f38af1cd97064964.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a948e3c1f98692cf0260e70a5bf821ced378eeaf28ee299f38af1cd97064964.dll,#1
  2⤵
  PID:1432

memory/1432-132-0x0000000000000000-mapping.dmp

Download
memory/1432-133-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download