7a34c1d1c37ff2ca7518cbd7e2af973c557c60848015c4051c640072805d7745

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 07:19

Target

7a34c1d1c37ff2ca7518cbd7e2af973c557c60848015c4051c640072805d7745.dll
Size

128KB
MD5

a286360434339883e0144a0ed985357f
SHA1

9efb44e0978b223c9908b4832b04a3c089d11e0d
SHA256

7a34c1d1c37ff2ca7518cbd7e2af973c557c60848015c4051c640072805d7745
SHA512

9b06c5586cc1babfc03cfd71a31b2d7f31a4d61e0b7e14259d3c97eb9798ef1ebdc92e58391fb17561ad98eb9cab9e913dc2bd1e4f80d1ccd376e3ceecc2b865
SSDEEP

3072:fLu0zVC7qE3qUhTVTFH6QEu1hFDDngs+Fw/wSa:ju2453rTVTFuu1hFngdFv

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1996-56-0x0000000000280000-0x000000000028E000-memory.dmp	upx
behavioral1/memory/1996-60-0x0000000000280000-0x000000000028E000-memory.dmp	upx
behavioral1/memory/1996-59-0x0000000000280000-0x000000000028E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 1996	1168	rundll32.exe	27
PID 1168 wrote to memory of 1996	1168	rundll32.exe	27
PID 1168 wrote to memory of 1996	1168	rundll32.exe	27
PID 1168 wrote to memory of 1996	1168	rundll32.exe	27
PID 1168 wrote to memory of 1996	1168	rundll32.exe	27
PID 1168 wrote to memory of 1996	1168	rundll32.exe	27
PID 1168 wrote to memory of 1996	1168	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a34c1d1c37ff2ca7518cbd7e2af973c557c60848015c4051c640072805d7745.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a34c1d1c37ff2ca7518cbd7e2af973c557c60848015c4051c640072805d7745.dll,#1
  2⤵
  PID:1996

memory/1996-54-0x0000000000000000-mapping.dmp

Download
memory/1996-55-0x00000000760E1000-0x00000000760E3000-memory.dmp

Filesize
8KB

Download
memory/1996-56-0x0000000000280000-0x000000000028E000-memory.dmp

Filesize
56KB

Download
memory/1996-60-0x0000000000280000-0x000000000028E000-memory.dmp

Filesize
56KB

Download
memory/1996-59-0x0000000000280000-0x000000000028E000-memory.dmp

Filesize
56KB

Download
memory/1996-61-0x00000000001A0000-0x00000000001A8000-memory.dmp

Filesize
32KB

Download
memory/1996-62-0x0000000000287000-0x000000000028D000-memory.dmp

Filesize
24KB

Download
memory/1996-63-0x0000000000281000-0x0000000000287000-memory.dmp

Filesize
24KB

Download