fcd71764a85d33c655e0e05ff49cd0a83ba253bdca9ca58c7d9c028fe7b0af72

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 02:28

Target

fcd71764a85d33c655e0e05ff49cd0a83ba253bdca9ca58c7d9c028fe7b0af72.dll
Size

132KB
MD5

16a07238551d1938dc96b15158402b95
SHA1

9aceb6609231bea2406dea6084612482c7bb917c
SHA256

fcd71764a85d33c655e0e05ff49cd0a83ba253bdca9ca58c7d9c028fe7b0af72
SHA512

7f1bc942e9e552de4f740d5c847a128fc9e2f3da81be8dfc3b5c66ab53f774a5e224b1271cc82b27ab046e2837fe4e66effe4021d4724bdcb7f38c2d4c4c8742
SSDEEP

3072:wXmrQCFfWjdxFIpFgb30lFOSnlT/VW4DsImXUV:w8MzFIbgrU1VW4D0XU

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1516-56-0x0000000000180000-0x000000000018D000-memory.dmp	upx
behavioral1/memory/1516-60-0x0000000000180000-0x000000000018D000-memory.dmp	upx
behavioral1/memory/1516-59-0x0000000000180000-0x000000000018D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fcd71764a85d33c655e0e05ff49cd0a83ba253bdca9ca58c7d9c028fe7b0af72.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fcd71764a85d33c655e0e05ff49cd0a83ba253bdca9ca58c7d9c028fe7b0af72.dll,#1
  2⤵
  PID:1516

memory/1516-55-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download
memory/1516-56-0x0000000000180000-0x000000000018D000-memory.dmp

Filesize
52KB

Download
memory/1516-60-0x0000000000180000-0x000000000018D000-memory.dmp

Filesize
52KB

Download
memory/1516-59-0x0000000000180000-0x000000000018D000-memory.dmp

Filesize
52KB

Download
memory/1516-61-0x0000000000187000-0x000000000018C000-memory.dmp

Filesize
20KB

Download
memory/1516-62-0x0000000000181000-0x0000000000187000-memory.dmp

Filesize
24KB

Download