d195895f54daf488d7ff30c515a0ec9ec8a4ece9e7daf84076f5845865048cd7

Analysis

max time kernel
41s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 13:42

Target

d195895f54daf488d7ff30c515a0ec9ec8a4ece9e7daf84076f5845865048cd7.dll
Size

449KB
MD5

34f8dd9b142afba0f8c9fbd79d17cb50
SHA1

31d8cffdfad7fc209b23e654259628537a70883f
SHA256

d195895f54daf488d7ff30c515a0ec9ec8a4ece9e7daf84076f5845865048cd7
SHA512

031f080c91cefc5679b7649d3cffc0d54803bf250c3dd60ef7c9a4be89223c50d05a3186a9d0a9c48af237eda7f42b9ea34523a94bcdbfc3f0b953cdadf0e7ab
SSDEEP

6144:BusFqY6mmt6rXZeQyFaOetafTqjXfbZLbLJSADyqNDpd3aWq:BusFqY6mc6rpeQyF2zf9LbLHDyoL3X

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1388-56-0x00000000000B0000-0x00000000000BD000-memory.dmp	upx
behavioral1/memory/1388-60-0x00000000000B0000-0x00000000000BD000-memory.dmp	upx
behavioral1/memory/1388-59-0x00000000000B0000-0x00000000000BD000-memory.dmp	upx
behavioral1/memory/1388-61-0x00000000000B0000-0x00000000000BD000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d195895f54daf488d7ff30c515a0ec9ec8a4ece9e7daf84076f5845865048cd7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d195895f54daf488d7ff30c515a0ec9ec8a4ece9e7daf84076f5845865048cd7.dll,#1
  2⤵
  PID:1388

memory/1388-55-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/1388-56-0x00000000000B0000-0x00000000000BD000-memory.dmp

Filesize
52KB

Download
memory/1388-60-0x00000000000B0000-0x00000000000BD000-memory.dmp

Filesize
52KB

Download
memory/1388-59-0x00000000000B0000-0x00000000000BD000-memory.dmp

Filesize
52KB

Download
memory/1388-63-0x00000000000B1000-0x00000000000B6000-memory.dmp

Filesize
20KB

Download
memory/1388-62-0x00000000000B6000-0x00000000000BC000-memory.dmp

Filesize
24KB

Download
memory/1388-61-0x00000000000B0000-0x00000000000BD000-memory.dmp

Filesize
52KB

Download