995d1c47abb24956c20840aad3342fac032bcb2a872d378710daa8dd509fb175

Analysis

max time kernel
20s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 22:39

Target

995d1c47abb24956c20840aad3342fac032bcb2a872d378710daa8dd509fb175.dll
Size

4KB
MD5

93ea59f3cdfe9946276b965115279430
SHA1

e613c69554834b1bc8746a1510c9a9b0644250a7
SHA256

995d1c47abb24956c20840aad3342fac032bcb2a872d378710daa8dd509fb175
SHA512

ebe1720254ba2648a5ecb344178abf572b0cba4760eae5f3482b9263aa6afde6fd2e7ca04be7fcc8fde441e21e671502945372fed2e033262de758523c4be6eb
SSDEEP

48:a5zuMqBcq06phM/wwWLSeJY8JTa6Il+Lrr4g8LO86sm7RlO4rJDL+dPYaOgpcj3:TRphMzf8Ok/24VIAjgWT

Score

9^/10

upx

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/memory/1772-57-0x0000000074800000-0x0000000074808000-memory.dmp	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1772-57-0x0000000074800000-0x0000000074808000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 1772	1900	rundll32.exe	28
PID 1900 wrote to memory of 1772	1900	rundll32.exe	28
PID 1900 wrote to memory of 1772	1900	rundll32.exe	28
PID 1900 wrote to memory of 1772	1900	rundll32.exe	28
PID 1900 wrote to memory of 1772	1900	rundll32.exe	28
PID 1900 wrote to memory of 1772	1900	rundll32.exe	28
PID 1900 wrote to memory of 1772	1900	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\995d1c47abb24956c20840aad3342fac032bcb2a872d378710daa8dd509fb175.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\995d1c47abb24956c20840aad3342fac032bcb2a872d378710daa8dd509fb175.dll,#1
  2⤵
  PID:1772

memory/1772-55-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download
memory/1772-56-0x0000000074810000-0x0000000074818000-memory.dmp

Filesize
32KB

Download
memory/1772-57-0x0000000074800000-0x0000000074808000-memory.dmp

Filesize
32KB

Download