c158e76bf255f5d999e627577a183c4e16ce1860367998697250866fce0b5cd7

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 22:25

Target

c158e76bf255f5d999e627577a183c4e16ce1860367998697250866fce0b5cd7.dll
Size

4KB
MD5

fc96e8dfa0509b9d3e13a091059de2a0
SHA1

44ab1a0430186f6bb2203b9473de768b792afd72
SHA256

c158e76bf255f5d999e627577a183c4e16ce1860367998697250866fce0b5cd7
SHA512

43e793fc1c7258c6bd6e831ec61938e8b791ef26f1b29ddaa997ecf3dfa665b0fc13c16ed2a6957237ee65e89d7a10b51c9f471e2dbfbd153843a4093e334e4a
SSDEEP

48:a5zuMqBcq06phM/wwWLSeJY8JTa6Il+LAbenVG7myS0huZXG71UHtB0eCT1KLgY6:TRphMzf8OoG7S0wX+UNXpgYm/bHrL

Score

9^/10

upx

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/memory/548-57-0x00000000746B0000-0x00000000746B8000-memory.dmp	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/548-57-0x00000000746B0000-0x00000000746B8000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 548	1148	rundll32.exe	27
PID 1148 wrote to memory of 548	1148	rundll32.exe	27
PID 1148 wrote to memory of 548	1148	rundll32.exe	27
PID 1148 wrote to memory of 548	1148	rundll32.exe	27
PID 1148 wrote to memory of 548	1148	rundll32.exe	27
PID 1148 wrote to memory of 548	1148	rundll32.exe	27
PID 1148 wrote to memory of 548	1148	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c158e76bf255f5d999e627577a183c4e16ce1860367998697250866fce0b5cd7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c158e76bf255f5d999e627577a183c4e16ce1860367998697250866fce0b5cd7.dll,#1
  2⤵
  PID:548

memory/548-55-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download
memory/548-56-0x00000000746C0000-0x00000000746C8000-memory.dmp

Filesize
32KB

Download
memory/548-57-0x00000000746B0000-0x00000000746B8000-memory.dmp

Filesize
32KB

Download
memory/548-58-0x00000000746C0000-0x00000000746C8000-memory.dmp

Filesize
32KB

Download