ab81037485220203edbb1a8697836d163aa2caabe8aa8257a8ae00ad25ef2ab4

Analysis

max time kernel
38s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 20:35

Target

ab81037485220203edbb1a8697836d163aa2caabe8aa8257a8ae00ad25ef2ab4.dll
Size

384KB
MD5

c826a760fb5ffd478507f78ebd18ba50
SHA1

ea1fae557fce2e6ce5a66d2339d44d5049c7a2c4
SHA256

ab81037485220203edbb1a8697836d163aa2caabe8aa8257a8ae00ad25ef2ab4
SHA512

b859890111b542e9fdf083b2b265816aec072a587727ee650b6909f13240e51f7e24c3295ef714957940db404af74ac73759360e2709263877c9e69e8734f69a
SSDEEP

3072:cz+JhoaEecYueYFVVA+HvtZDmSrbyHTNRLwZfUi3DfdEfsRzCgM11aZa:u+JhorecYueYFbLyHTLmMi3TGf+211

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/876-56-0x0000000010000000-0x0000000010061000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 584 wrote to memory of 876	584	rundll32.exe	28
PID 584 wrote to memory of 876	584	rundll32.exe	28
PID 584 wrote to memory of 876	584	rundll32.exe	28
PID 584 wrote to memory of 876	584	rundll32.exe	28
PID 584 wrote to memory of 876	584	rundll32.exe	28
PID 584 wrote to memory of 876	584	rundll32.exe	28
PID 584 wrote to memory of 876	584	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab81037485220203edbb1a8697836d163aa2caabe8aa8257a8ae00ad25ef2ab4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:584
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab81037485220203edbb1a8697836d163aa2caabe8aa8257a8ae00ad25ef2ab4.dll,#1
  2⤵
  PID:876

memory/876-55-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/876-56-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download