b736674f58febc22e7cf9a99cadce478b09287a2fcf6a520f153cfafb525c029

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 23:17

Target

b736674f58febc22e7cf9a99cadce478b09287a2fcf6a520f153cfafb525c029.dll
Size

32KB
MD5

1bde2cf7c130dea0557cd716c5df2021
SHA1

6c851a820984e860967df1ff3cae4a817fc222fa
SHA256

b736674f58febc22e7cf9a99cadce478b09287a2fcf6a520f153cfafb525c029
SHA512

bf7e9d7d4d47329bb8b4b985ddee5c8cc7e7f9d793a0482e5217dcef682b6c753f17cc877dd0a4dcf63e4a89f7ff7259dfb895183c74503c4722ef9e35e9c198
SSDEEP

768:3cR5YBJjVUqk08Y99ZA5n/KnyEE2Osoa0W:M8WqkjGqnREdO+3

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1748-58-0x00000000000B0000-0x00000000000C8000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 1748	1484	rundll32.exe	20
PID 1484 wrote to memory of 1748	1484	rundll32.exe	20
PID 1484 wrote to memory of 1748	1484	rundll32.exe	20
PID 1484 wrote to memory of 1748	1484	rundll32.exe	20
PID 1484 wrote to memory of 1748	1484	rundll32.exe	20
PID 1484 wrote to memory of 1748	1484	rundll32.exe	20
PID 1484 wrote to memory of 1748	1484	rundll32.exe	20

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b736674f58febc22e7cf9a99cadce478b09287a2fcf6a520f153cfafb525c029.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b736674f58febc22e7cf9a99cadce478b09287a2fcf6a520f153cfafb525c029.dll,#1
  2⤵
  PID:1748

memory/1748-55-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1748-56-0x00000000000A0000-0x00000000000B8000-memory.dmp

Filesize
96KB

Download
memory/1748-57-0x00000000000A0000-0x00000000000B8000-memory.dmp

Filesize
96KB

Download
memory/1748-58-0x00000000000B0000-0x00000000000C8000-memory.dmp

Filesize
96KB

Download
memory/1748-59-0x00000000000A0000-0x00000000000B8000-memory.dmp

Filesize
96KB

Download
memory/1748-60-0x00000000000B0000-0x00000000000C8000-memory.dmp

Filesize
96KB

Download