863ff7a3417cd6c3e9f7f1e466461677333735a57b840c331b1940cc790d118e

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 21:52

Target

863ff7a3417cd6c3e9f7f1e466461677333735a57b840c331b1940cc790d118e.dll
Size

967KB
MD5

3f60eaa8a2a8d82167af3332bcc68c58
SHA1

f712a4011bde2ae57b3ed49726ff3d62572e4020
SHA256

863ff7a3417cd6c3e9f7f1e466461677333735a57b840c331b1940cc790d118e
SHA512

5a172e04e335f47e70a6fdd1b551eddb6141d70e3d413634d1d22537fb6128ae400914c9dd4c66ba1dd1aa20d55840f9ae6568c698264001d8d313c800fd4e3d
SSDEEP

24576:kDgDgDgDgDgDgDgDgDgDgDgDgDgDgDgDgDgDgDgDgDgDgDgDgDgDgD7DDDDDDDDD:Ycccccccccccccccccccccccccc7DDDn

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1080-56-0x0000000010000000-0x0000000010016000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\863ff7a3417cd6c3e9f7f1e466461677333735a57b840c331b1940cc790d118e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\863ff7a3417cd6c3e9f7f1e466461677333735a57b840c331b1940cc790d118e.dll,#1
  2⤵
  PID:1080

memory/1080-55-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download
memory/1080-56-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download