e0bbb26137e9998b5c2901957b8ed6732c7c8ccf5cd14fca8e8c3e6a1c633be7

Analysis

max time kernel
9s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 22:12

Target

e0bbb26137e9998b5c2901957b8ed6732c7c8ccf5cd14fca8e8c3e6a1c633be7.dll
Size

4KB
MD5

b6b8a005064e8d502c11d3dba8738af0
SHA1

e4745b132f0fe740216a90759eee6930ebac8c5f
SHA256

e0bbb26137e9998b5c2901957b8ed6732c7c8ccf5cd14fca8e8c3e6a1c633be7
SHA512

c414d143b0c0324ff7bf02a547d013b30998f2b1afef4cd4dadcd0209d757c84b5e94f318a2834c7dbd8f93f49e8f611f1d49d565e79aa508403ed3ed30485eb
SSDEEP

48:a5zuMqBcq06phM/wwWLSeJY8JTa6Il+Ln4iD7pElRaAPEOpUzPhn37Yzt25kYuto:TRphMzf8n4U7KMCEOaLi+kYfQ5pnzA

Score

9^/10

upx

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/memory/940-57-0x00000000749D0000-0x00000000749D8000-memory.dmp	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/940-57-0x00000000749D0000-0x00000000749D8000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 940	1376	rundll32.exe	28
PID 1376 wrote to memory of 940	1376	rundll32.exe	28
PID 1376 wrote to memory of 940	1376	rundll32.exe	28
PID 1376 wrote to memory of 940	1376	rundll32.exe	28
PID 1376 wrote to memory of 940	1376	rundll32.exe	28
PID 1376 wrote to memory of 940	1376	rundll32.exe	28
PID 1376 wrote to memory of 940	1376	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e0bbb26137e9998b5c2901957b8ed6732c7c8ccf5cd14fca8e8c3e6a1c633be7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e0bbb26137e9998b5c2901957b8ed6732c7c8ccf5cd14fca8e8c3e6a1c633be7.dll,#1
  2⤵
  PID:940

memory/940-55-0x0000000075B61000-0x0000000075B63000-memory.dmp

Filesize
8KB

Download
memory/940-56-0x00000000749E0000-0x00000000749E8000-memory.dmp

Filesize
32KB

Download
memory/940-57-0x00000000749D0000-0x00000000749D8000-memory.dmp

Filesize
32KB

Download
memory/940-58-0x00000000749E0000-0x00000000749E8000-memory.dmp

Filesize
32KB

Download