01c99e280fa9592855885748b317fd66b994e469e92c64ed2b90ee15c930291b

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 06:59

Target

01c99e280fa9592855885748b317fd66b994e469e92c64ed2b90ee15c930291b.dll
Size

136KB
MD5

e75081fb0a2a61497a79bf6205908cf0
SHA1

ed3350f73469de77550099d16f21e27e09a3ad98
SHA256

01c99e280fa9592855885748b317fd66b994e469e92c64ed2b90ee15c930291b
SHA512

5d7d3dfc14c2698d38a72e1eeec0185d90e84e4c9637e8cdd7ae5609632ee2fc3a95d859fc26f70a8eb6ced93125f538f2f1d90bba836c0e6ee91cac2312c5c8
SSDEEP

1536:eQil3UPcEQt1QJEJCuoMLMZlYybR9qVG1SL8wD4oKW5V0k93LlYIpNieV:zil3UPjQtYBMg+KqVZK+V0kFLlNNi

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/840-56-0x000000007EE00000-0x000000007EE38000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 840	1000	rundll32.exe	27
PID 1000 wrote to memory of 840	1000	rundll32.exe	27
PID 1000 wrote to memory of 840	1000	rundll32.exe	27
PID 1000 wrote to memory of 840	1000	rundll32.exe	27
PID 1000 wrote to memory of 840	1000	rundll32.exe	27
PID 1000 wrote to memory of 840	1000	rundll32.exe	27
PID 1000 wrote to memory of 840	1000	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01c99e280fa9592855885748b317fd66b994e469e92c64ed2b90ee15c930291b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01c99e280fa9592855885748b317fd66b994e469e92c64ed2b90ee15c930291b.dll,#1
  2⤵
  PID:840

memory/840-55-0x0000000076561000-0x0000000076563000-memory.dmp

Filesize
8KB

Download
memory/840-56-0x000000007EE00000-0x000000007EE38000-memory.dmp

Filesize
224KB

Download