0ee2aaaaf924f3484e8ca98c330c48d455b867e1abc48041fd56067fec087354

Analysis

max time kernel
35s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 20:58

Target

0ee2aaaaf924f3484e8ca98c330c48d455b867e1abc48041fd56067fec087354.dll
Size

71KB
MD5

dab17792dfdc13516c8d5cfc50c24d80
SHA1

7fef48a24a77c35a58f2ed493222414632cdbaf8
SHA256

0ee2aaaaf924f3484e8ca98c330c48d455b867e1abc48041fd56067fec087354
SHA512

2547574d18712896e1e4bc5b040204460ee580019869fd873303b941566dff765dbb8c2f4013817fbb8ccdf648521295258a0508669b1a4122f786b921fdb149
SSDEEP

1536:g2kZzX67WEtYXo+SPVdwhq2pqRsf6leRAwa43:ejhXLS3h6RAwv3

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1476-56-0x0000000010000000-0x0000000010013000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1476	1096	rundll32.exe	26
PID 1096 wrote to memory of 1476	1096	rundll32.exe	26
PID 1096 wrote to memory of 1476	1096	rundll32.exe	26
PID 1096 wrote to memory of 1476	1096	rundll32.exe	26
PID 1096 wrote to memory of 1476	1096	rundll32.exe	26
PID 1096 wrote to memory of 1476	1096	rundll32.exe	26
PID 1096 wrote to memory of 1476	1096	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ee2aaaaf924f3484e8ca98c330c48d455b867e1abc48041fd56067fec087354.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ee2aaaaf924f3484e8ca98c330c48d455b867e1abc48041fd56067fec087354.dll,#1
  2⤵
  PID:1476

memory/1476-54-0x0000000000000000-mapping.dmp

Download
memory/1476-55-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1476-56-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download