9395316c2297f6234e3fcabbdc60983fc25ac8146ca1e2885fb3414c8369b700

Analysis

max time kernel
246s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 00:37

Target

9395316c2297f6234e3fcabbdc60983fc25ac8146ca1e2885fb3414c8369b700.dll
Size

144KB
MD5

f28e91fc91afd9b1606549aa33d38ec7
SHA1

e9f839e835ee14290532953abf12eb59253df195
SHA256

9395316c2297f6234e3fcabbdc60983fc25ac8146ca1e2885fb3414c8369b700
SHA512

4d9748c61c7f073f3c2d2d1a2502673385432e0ede5a206306d7d91cece3cd58b6db0e0fe33b401d5e4795eb24c7a30858eaf817a38238b670397efb5ec80f02
SSDEEP

3072:GGM8cmrYaCCTcoiF8Yat7PsPCrUyG8wrrlxOcB:GGM8J0ic9F8Yk7kJyE3ZB

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/652-56-0x0000000000240000-0x000000000024D000-memory.dmp	upx
behavioral1/memory/652-59-0x0000000000240000-0x000000000024D000-memory.dmp	upx
behavioral1/memory/652-60-0x0000000000240000-0x000000000024D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 652	560	rundll32.exe	28
PID 560 wrote to memory of 652	560	rundll32.exe	28
PID 560 wrote to memory of 652	560	rundll32.exe	28
PID 560 wrote to memory of 652	560	rundll32.exe	28
PID 560 wrote to memory of 652	560	rundll32.exe	28
PID 560 wrote to memory of 652	560	rundll32.exe	28
PID 560 wrote to memory of 652	560	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9395316c2297f6234e3fcabbdc60983fc25ac8146ca1e2885fb3414c8369b700.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9395316c2297f6234e3fcabbdc60983fc25ac8146ca1e2885fb3414c8369b700.dll,#1
  2⤵
  PID:652

memory/652-55-0x0000000076391000-0x0000000076393000-memory.dmp

Filesize
8KB

Download
memory/652-56-0x0000000000240000-0x000000000024D000-memory.dmp

Filesize
52KB

Download
memory/652-59-0x0000000000240000-0x000000000024D000-memory.dmp

Filesize
52KB

Download
memory/652-60-0x0000000000240000-0x000000000024D000-memory.dmp

Filesize
52KB

Download
memory/652-61-0x0000000000247000-0x000000000024C000-memory.dmp

Filesize
20KB

Download
memory/652-62-0x0000000000241000-0x0000000000247000-memory.dmp

Filesize
24KB

Download