145c89ada80122c2d9ef4c54dfa5ba6ac6054525dd1123a29df7daf98035f53a

Analysis

max time kernel
142s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 05:58

Target

145c89ada80122c2d9ef4c54dfa5ba6ac6054525dd1123a29df7daf98035f53a.dll
Size

91KB
MD5

71a52a05b72afd31ebb8e2ae3ad0c560
SHA1

01d3e54e0fcea1e23c299dc2520089e0195093d5
SHA256

145c89ada80122c2d9ef4c54dfa5ba6ac6054525dd1123a29df7daf98035f53a
SHA512

b9ab75dda4584f01a90d036e3d4d058f65a4199a9db74436681086fee78f60090d751af408930ee84bc1395f795b8dbe02cf0b92d6d577317c8d7c2cd2b488e5
SSDEEP

1536:8THQpoCr4GTnagdolDkWALl49iXCsU6L2KE+Q2MBDHvSIkhwpbB:8THRRpmoDAkJ6L452MNv0ObB

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1940-56-0x0000000000700000-0x000000000072E000-memory.dmp	upx
behavioral1/memory/1940-58-0x0000000000700000-0x000000000072E000-memory.dmp	upx
behavioral1/memory/1940-59-0x0000000000700000-0x000000000072E000-memory.dmp	upx
behavioral1/memory/1940-60-0x0000000000700000-0x000000000072E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 520 wrote to memory of 1940	520	rundll32.exe	28
PID 520 wrote to memory of 1940	520	rundll32.exe	28
PID 520 wrote to memory of 1940	520	rundll32.exe	28
PID 520 wrote to memory of 1940	520	rundll32.exe	28
PID 520 wrote to memory of 1940	520	rundll32.exe	28
PID 520 wrote to memory of 1940	520	rundll32.exe	28
PID 520 wrote to memory of 1940	520	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\145c89ada80122c2d9ef4c54dfa5ba6ac6054525dd1123a29df7daf98035f53a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\145c89ada80122c2d9ef4c54dfa5ba6ac6054525dd1123a29df7daf98035f53a.dll,#1
  2⤵
  PID:1940

memory/1940-55-0x0000000075441000-0x0000000075443000-memory.dmp

Filesize
8KB

Download
memory/1940-56-0x0000000000700000-0x000000000072E000-memory.dmp

Filesize
184KB

Download
memory/1940-57-0x0000000000220000-0x000000000024F000-memory.dmp

Filesize
188KB

Download
memory/1940-58-0x0000000000700000-0x000000000072E000-memory.dmp

Filesize
184KB

Download
memory/1940-59-0x0000000000700000-0x000000000072E000-memory.dmp

Filesize
184KB

Download
memory/1940-60-0x0000000000700000-0x000000000072E000-memory.dmp

Filesize
184KB

Download