2231a8fd6d1976ddbdbf2cd5c031b8077205fe22d4d9aa3e1fc83eccd66d842a

Analysis

max time kernel
53s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 19:08

Target

2231a8fd6d1976ddbdbf2cd5c031b8077205fe22d4d9aa3e1fc83eccd66d842a.dll
Size

45KB
MD5

3ef97d997151aab17f0a75f978dd4d90
SHA1

0156e8e2bcab7e8872fa87f2a25383bb1109f5ac
SHA256

2231a8fd6d1976ddbdbf2cd5c031b8077205fe22d4d9aa3e1fc83eccd66d842a
SHA512

c0759b52c20ae5011d1080e6ee4bf639c84c6f6f9820856a7baaf1092b94cd8061374a6047516be96bfef505b264f0174f4acafd5339291b32a0e2385cab6440
SSDEEP

768:vW+anfMF6h6q3LUThFU5Ho6QZhI5G1jl7JLGEtWbVlegOobagMF7BErqnlzTMTjD:vFanfonWuA5I6QIcXaEgZvOougMFyrq+

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/948-56-0x0000000010000000-0x0000000010046000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 948	1516	rundll32.exe	28
PID 1516 wrote to memory of 948	1516	rundll32.exe	28
PID 1516 wrote to memory of 948	1516	rundll32.exe	28
PID 1516 wrote to memory of 948	1516	rundll32.exe	28
PID 1516 wrote to memory of 948	1516	rundll32.exe	28
PID 1516 wrote to memory of 948	1516	rundll32.exe	28
PID 1516 wrote to memory of 948	1516	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2231a8fd6d1976ddbdbf2cd5c031b8077205fe22d4d9aa3e1fc83eccd66d842a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2231a8fd6d1976ddbdbf2cd5c031b8077205fe22d4d9aa3e1fc83eccd66d842a.dll,#1
  2⤵
  PID:948

memory/948-55-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/948-56-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download