6bf913dd582c246b7fcc0e7f075d86c345d9ee7df311994c1a6d5941f156b8d1

Analysis

max time kernel
73s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 19:29

Target

6bf913dd582c246b7fcc0e7f075d86c345d9ee7df311994c1a6d5941f156b8d1.dll
Size

62KB
MD5

741460eabbf08a5e8ad50f61794883b0
SHA1

5b89de13a324cd3dae750bfa4d1716f5acbdf5d2
SHA256

6bf913dd582c246b7fcc0e7f075d86c345d9ee7df311994c1a6d5941f156b8d1
SHA512

ef86f04de87cc7f50c697dd05051ea33f370ea28757b18b0087cf233c2400372130144692917433a83d562f9800329c6bc8876b7bb645b17b59ae34c1fbf3c14
SSDEEP

1536:O/S0tJ5FMUzxs2nj6U0Sawyw1v+MTaxusFEZ8T:O/S0JFMUzOC7z1lZTtsiZG

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1068-56-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1068	1492	rundll32.exe	28
PID 1492 wrote to memory of 1068	1492	rundll32.exe	28
PID 1492 wrote to memory of 1068	1492	rundll32.exe	28
PID 1492 wrote to memory of 1068	1492	rundll32.exe	28
PID 1492 wrote to memory of 1068	1492	rundll32.exe	28
PID 1492 wrote to memory of 1068	1492	rundll32.exe	28
PID 1492 wrote to memory of 1068	1492	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6bf913dd582c246b7fcc0e7f075d86c345d9ee7df311994c1a6d5941f156b8d1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6bf913dd582c246b7fcc0e7f075d86c345d9ee7df311994c1a6d5941f156b8d1.dll,#1
  2⤵
  PID:1068

memory/1068-55-0x0000000075491000-0x0000000075493000-memory.dmp

Filesize
8KB

Download
memory/1068-56-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download