c5d45ce8f5c3be82e5ecc060b8eb4e469584ef7c227852fc58bf300ac9a7fae8

Analysis

max time kernel
41s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 07:45

Target

c5d45ce8f5c3be82e5ecc060b8eb4e469584ef7c227852fc58bf300ac9a7fae8.dll
Size

170KB
MD5

3a9bf0b4b32a78016649ba2ee6c04eee
SHA1

bda33471b99fae190c95137a54d3f3c0f6bfe3f8
SHA256

c5d45ce8f5c3be82e5ecc060b8eb4e469584ef7c227852fc58bf300ac9a7fae8
SHA512

73fc2fd7232a34bc60fea5a7dfc2dbf5d86507a996976bf64c05fb42b2f0902e37b62d41b8ccf221eac9ff2228ac9348e751c135229ad315ac69b14467bc4299
SSDEEP

3072:DvcCUevFdKvBJZ+PtNyikGRadrT0VLLoOWVqjJSt1DieOOS1VmRa0FiR3X:DvcMsVviXqrT0VIV4EieODnmRw3X

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1636-56-0x0000000010000000-0x0000000010086000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 1636	960	rundll32.exe	28
PID 960 wrote to memory of 1636	960	rundll32.exe	28
PID 960 wrote to memory of 1636	960	rundll32.exe	28
PID 960 wrote to memory of 1636	960	rundll32.exe	28
PID 960 wrote to memory of 1636	960	rundll32.exe	28
PID 960 wrote to memory of 1636	960	rundll32.exe	28
PID 960 wrote to memory of 1636	960	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5d45ce8f5c3be82e5ecc060b8eb4e469584ef7c227852fc58bf300ac9a7fae8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5d45ce8f5c3be82e5ecc060b8eb4e469584ef7c227852fc58bf300ac9a7fae8.dll,#1
  2⤵
  PID:1636

memory/1636-55-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1636-56-0x0000000010000000-0x0000000010086000-memory.dmp

Filesize
536KB

Download