a3778eeda7b459a576b7689e6740fb66d7512a015c68e0310fa538aed2070a00

Analysis

max time kernel
15s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 16:54

Target

a3778eeda7b459a576b7689e6740fb66d7512a015c68e0310fa538aed2070a00.dll
Size

124KB
MD5

9cf55f9c01b5ac5263704d704b8a3ce9
SHA1

600d1d2fed7bded50b7f89004849e20fc54dfd5a
SHA256

a3778eeda7b459a576b7689e6740fb66d7512a015c68e0310fa538aed2070a00
SHA512

962869f13ef7dbcc38e378f2732f2ffb58940b35577223bb275dff7f20edc9d02f6426f82d042e3df6f0113ba3ab55cf39c786b32346e5febc260a8bd5e81178
SSDEEP

3072:3wwpKkoo9c+nvYc2Yn25KozC+VWH39K4+m4HgIbrRj+8SOlD:Awp6o9fngE2oozZVWHt8F

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1552-56-0x00000000006A0000-0x00000000006FF000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 1552	1796	rundll32.exe	28
PID 1796 wrote to memory of 1552	1796	rundll32.exe	28
PID 1796 wrote to memory of 1552	1796	rundll32.exe	28
PID 1796 wrote to memory of 1552	1796	rundll32.exe	28
PID 1796 wrote to memory of 1552	1796	rundll32.exe	28
PID 1796 wrote to memory of 1552	1796	rundll32.exe	28
PID 1796 wrote to memory of 1552	1796	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3778eeda7b459a576b7689e6740fb66d7512a015c68e0310fa538aed2070a00.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3778eeda7b459a576b7689e6740fb66d7512a015c68e0310fa538aed2070a00.dll,#1
  2⤵
  PID:1552

memory/1552-55-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/1552-56-0x00000000006A0000-0x00000000006FF000-memory.dmp

Filesize
380KB

Download