2e241ccaca9223fafeda03d1b5e2c576400625c33d298e7ff6e8251b2abe98ec

Analysis

max time kernel
15s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 23:16

Target

2e241ccaca9223fafeda03d1b5e2c576400625c33d298e7ff6e8251b2abe98ec.dll
Size

4KB
MD5

c2152a70259914ad1f571d2aa7053e20
SHA1

341cb2f2632916569d3dfd3df5675b43ea7ed335
SHA256

2e241ccaca9223fafeda03d1b5e2c576400625c33d298e7ff6e8251b2abe98ec
SHA512

7f12af856b9ec904cf3a9c15168da9767d18ebd21bc1efdb39dc0ef903cfd9b4622136e27e422f773ae49a345026ecd9e654701e995be5c97aff488095247ad8
SSDEEP

48:a5zuMqBcq06phM/wwWLSeJY8JTa6Il+LhNXnwBfUUkZJNONXFV0Vg4:TRphMzf8hNXaFkZTaVV0VB

Score

9^/10

upx

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/memory/1676-57-0x00000000747A0000-0x00000000747A8000-memory.dmp	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1676-57-0x00000000747A0000-0x00000000747A8000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 1676	1584	rundll32.exe	28
PID 1584 wrote to memory of 1676	1584	rundll32.exe	28
PID 1584 wrote to memory of 1676	1584	rundll32.exe	28
PID 1584 wrote to memory of 1676	1584	rundll32.exe	28
PID 1584 wrote to memory of 1676	1584	rundll32.exe	28
PID 1584 wrote to memory of 1676	1584	rundll32.exe	28
PID 1584 wrote to memory of 1676	1584	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e241ccaca9223fafeda03d1b5e2c576400625c33d298e7ff6e8251b2abe98ec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e241ccaca9223fafeda03d1b5e2c576400625c33d298e7ff6e8251b2abe98ec.dll,#1
  2⤵
  PID:1676

memory/1676-55-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/1676-56-0x00000000747B0000-0x00000000747B8000-memory.dmp

Filesize
32KB

Download
memory/1676-57-0x00000000747A0000-0x00000000747A8000-memory.dmp

Filesize
32KB

Download
memory/1676-58-0x00000000747B0000-0x00000000747B8000-memory.dmp

Filesize
32KB

Download