2549e9fcfc77dcb114e03592bb4d2693fb6c0dea0601d6e05a9f2f552a121e3c

Analysis

max time kernel
47s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 10:16

Target

2549e9fcfc77dcb114e03592bb4d2693fb6c0dea0601d6e05a9f2f552a121e3c.dll
Size

49KB
MD5

64674a8bb576d7648f8b1bdd8c7f3980
SHA1

85ecea692856a2c3adf6280b4e02545b1c36e149
SHA256

2549e9fcfc77dcb114e03592bb4d2693fb6c0dea0601d6e05a9f2f552a121e3c
SHA512

58114eb9bce616dc211f8770ea1303710ceef0c12e241e344240ac51e09f4e9ec0f742e86357943a0bc082f1b121157da8bae9557b209cca8589d57fc7578044
SSDEEP

768:rNzy1Dnhfwh7eQcpocm4MEpUIJoF65jbJ1UnvnmiUZOBfg9YzlCwyYLO:Rzy1D6NcPM4Jl5b5iJeeHL

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/344-56-0x0000000010000000-0x0000000010044000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 280 wrote to memory of 344	280	rundll32.exe	28
PID 280 wrote to memory of 344	280	rundll32.exe	28
PID 280 wrote to memory of 344	280	rundll32.exe	28
PID 280 wrote to memory of 344	280	rundll32.exe	28
PID 280 wrote to memory of 344	280	rundll32.exe	28
PID 280 wrote to memory of 344	280	rundll32.exe	28
PID 280 wrote to memory of 344	280	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2549e9fcfc77dcb114e03592bb4d2693fb6c0dea0601d6e05a9f2f552a121e3c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2549e9fcfc77dcb114e03592bb4d2693fb6c0dea0601d6e05a9f2f552a121e3c.dll,#1
  2⤵
  PID:344

memory/344-55-0x0000000075701000-0x0000000075703000-memory.dmp

Filesize
8KB

Download
memory/344-56-0x0000000010000000-0x0000000010044000-memory.dmp

Filesize
272KB

Download