387db3d1b82c9077120503db5bbd95eb4e8722805b410451d325712ea7de1524

Analysis

max time kernel
239s
max time network
337s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 09:26

Target

387db3d1b82c9077120503db5bbd95eb4e8722805b410451d325712ea7de1524.dll
Size

284KB
MD5

822dfc2cb2f04a40daf371c289f7eaf0
SHA1

d3e09ce0d9893b7e60220bb24b72a20ddff2324d
SHA256

387db3d1b82c9077120503db5bbd95eb4e8722805b410451d325712ea7de1524
SHA512

95b0de971c2b5d21ed3258ce71aa5b083d39fe4a9aa0f159159dde9a6c54bd813787ea0952700baa3b275c12b994cc1748f73f9951a8c5d6eb4179ed7ae797bc
SSDEEP

6144:CPkegtQUar+vmt06eWA2MIIo96680ln90:CAiUY+Oa2jIK6o30

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/576-56-0x0000000000120000-0x000000000012D000-memory.dmp	upx
behavioral1/memory/576-60-0x0000000000120000-0x000000000012D000-memory.dmp	upx
behavioral1/memory/576-59-0x0000000000120000-0x000000000012D000-memory.dmp	upx
behavioral1/memory/576-61-0x0000000000120000-0x000000000012D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 576	564	rundll32.exe	28
PID 564 wrote to memory of 576	564	rundll32.exe	28
PID 564 wrote to memory of 576	564	rundll32.exe	28
PID 564 wrote to memory of 576	564	rundll32.exe	28
PID 564 wrote to memory of 576	564	rundll32.exe	28
PID 564 wrote to memory of 576	564	rundll32.exe	28
PID 564 wrote to memory of 576	564	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\387db3d1b82c9077120503db5bbd95eb4e8722805b410451d325712ea7de1524.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\387db3d1b82c9077120503db5bbd95eb4e8722805b410451d325712ea7de1524.dll,#1
  2⤵
  PID:576

memory/576-55-0x00000000763A1000-0x00000000763A3000-memory.dmp

Filesize
8KB

Download
memory/576-56-0x0000000000120000-0x000000000012D000-memory.dmp

Filesize
52KB

Download
memory/576-60-0x0000000000120000-0x000000000012D000-memory.dmp

Filesize
52KB

Download
memory/576-59-0x0000000000120000-0x000000000012D000-memory.dmp

Filesize
52KB

Download
memory/576-61-0x0000000000120000-0x000000000012D000-memory.dmp

Filesize
52KB

Download
memory/576-62-0x0000000000126000-0x000000000012C000-memory.dmp

Filesize
24KB

Download
memory/576-63-0x0000000000121000-0x0000000000126000-memory.dmp

Filesize
20KB

Download