6f26e9d5eef02d7d3ab1de4fe4eca6113d7576d96df68163fbf271751fa04304

Analysis

max time kernel
37s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 19:20

Target

6f26e9d5eef02d7d3ab1de4fe4eca6113d7576d96df68163fbf271751fa04304.dll
Size

67KB
MD5

f32d13c5500cc29139c520551c16faa0
SHA1

c54b4136f29681a705a4c3937143951ba5893f94
SHA256

6f26e9d5eef02d7d3ab1de4fe4eca6113d7576d96df68163fbf271751fa04304
SHA512

14809ac864d6da33e9dabd4dee88215d8a191ec055eada9b61db8beb4bc20fbad613b6e9555ec679603dc370e5b981b6f90168cd06efa08c8dc3c155d40ceb5a
SSDEEP

1536:Bm1NGJVGbZdyNJZL081vRbJgVnJYXWDCTFl1DTQ:kX0VOZdyNLL0ORdiuaCZDk

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1956-56-0x0000000010000000-0x0000000010013000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 1956	1476	rundll32.exe	27
PID 1476 wrote to memory of 1956	1476	rundll32.exe	27
PID 1476 wrote to memory of 1956	1476	rundll32.exe	27
PID 1476 wrote to memory of 1956	1476	rundll32.exe	27
PID 1476 wrote to memory of 1956	1476	rundll32.exe	27
PID 1476 wrote to memory of 1956	1476	rundll32.exe	27
PID 1476 wrote to memory of 1956	1476	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f26e9d5eef02d7d3ab1de4fe4eca6113d7576d96df68163fbf271751fa04304.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f26e9d5eef02d7d3ab1de4fe4eca6113d7576d96df68163fbf271751fa04304.dll,#1
  2⤵
  PID:1956

memory/1956-55-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download
memory/1956-56-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download