22080824b2840b47a7f79fff2e811ef3c4f3e3fef1230454ab18aeafebca82f5

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 19:10

Target

22080824b2840b47a7f79fff2e811ef3c4f3e3fef1230454ab18aeafebca82f5.dll
Size

43KB
MD5

c833165eca96e69845e05af72feff0e0
SHA1

9888c615a3354e5f8da16bd6eabdbe9db26de18e
SHA256

22080824b2840b47a7f79fff2e811ef3c4f3e3fef1230454ab18aeafebca82f5
SHA512

7dc61f2cd582d2746955d152f784a6ef7a63ed961e69a48102d2616d2f89c26573d3daf6c1545a69588e4dbb88580009bc42d6e501dac13559bad03c16187a8b
SSDEEP

768:3oZVZA+BlTM5b9dOTweuSm7v6Yp1vWNGFkwJKB0ijWPb1Cza7V:3oHq+Dmb9teujL7p1vW0+vyjPbH7

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1488-56-0x0000000010000000-0x0000000010040000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1488	1960	rundll32.exe	28
PID 1960 wrote to memory of 1488	1960	rundll32.exe	28
PID 1960 wrote to memory of 1488	1960	rundll32.exe	28
PID 1960 wrote to memory of 1488	1960	rundll32.exe	28
PID 1960 wrote to memory of 1488	1960	rundll32.exe	28
PID 1960 wrote to memory of 1488	1960	rundll32.exe	28
PID 1960 wrote to memory of 1488	1960	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\22080824b2840b47a7f79fff2e811ef3c4f3e3fef1230454ab18aeafebca82f5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\22080824b2840b47a7f79fff2e811ef3c4f3e3fef1230454ab18aeafebca82f5.dll,#1
  2⤵
  PID:1488

memory/1488-54-0x0000000000000000-mapping.dmp

Download
memory/1488-55-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Filesize
8KB

Download
memory/1488-56-0x0000000010000000-0x0000000010040000-memory.dmp

Filesize
256KB

Download