46bcf877194436a89672ba79398ea493d38e74352d3e42d82429ef63950ce447

Analysis

max time kernel
7s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 13:42

Target

46bcf877194436a89672ba79398ea493d38e74352d3e42d82429ef63950ce447.dll
Size

336KB
MD5

a4f01dd2e7aea1c16eee945a52735500
SHA1

e24d2faae32fc3207d150a69e1fa4643ea026a59
SHA256

46bcf877194436a89672ba79398ea493d38e74352d3e42d82429ef63950ce447
SHA512

57a315ca14b3cf6201ad011b9464cf0a2346702d63b4b71d2f8917d24480077cfacbd9ea8ac345f94641d331c18db54e11e49121010a021c28a31e99c597e82b
SSDEEP

6144:BYR65cL+/EfEq6QgCdiy74pvKTTJ8xnSYK82+AqC1W/IPwJ:Bll/EfEq6QgCdiUSCTTCxSYK82+xwyw

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/940-56-0x00000000001E0000-0x00000000001EE000-memory.dmp	upx
behavioral1/memory/940-60-0x00000000001E0000-0x00000000001EE000-memory.dmp	upx
behavioral1/memory/940-59-0x00000000001E0000-0x00000000001EE000-memory.dmp	upx
behavioral1/memory/940-61-0x00000000001E0000-0x00000000001EE000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 940	1888	rundll32.exe	28
PID 1888 wrote to memory of 940	1888	rundll32.exe	28
PID 1888 wrote to memory of 940	1888	rundll32.exe	28
PID 1888 wrote to memory of 940	1888	rundll32.exe	28
PID 1888 wrote to memory of 940	1888	rundll32.exe	28
PID 1888 wrote to memory of 940	1888	rundll32.exe	28
PID 1888 wrote to memory of 940	1888	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\46bcf877194436a89672ba79398ea493d38e74352d3e42d82429ef63950ce447.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\46bcf877194436a89672ba79398ea493d38e74352d3e42d82429ef63950ce447.dll,#1
  2⤵
  PID:940

memory/940-55-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/940-56-0x00000000001E0000-0x00000000001EE000-memory.dmp

Filesize
56KB

Download
memory/940-60-0x00000000001E0000-0x00000000001EE000-memory.dmp

Filesize
56KB

Download
memory/940-59-0x00000000001E0000-0x00000000001EE000-memory.dmp

Filesize
56KB

Download
memory/940-61-0x00000000001E0000-0x00000000001EE000-memory.dmp

Filesize
56KB

Download
memory/940-62-0x00000000001E7000-0x00000000001ED000-memory.dmp

Filesize
24KB

Download
memory/940-63-0x00000000001E1000-0x00000000001E7000-memory.dmp

Filesize
24KB

Download