c3ae98508522cb30da360dea6364d24f970877334650216a942b4cf9b899a62f

Analysis

max time kernel
39s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 05:37

Target

c3ae98508522cb30da360dea6364d24f970877334650216a942b4cf9b899a62f.dll
Size

67KB
MD5

746f34d1644217f7d0ab45a681eef9b0
SHA1

dd0834f3240eff5fd8c19c7fcdb57f092b8b6045
SHA256

c3ae98508522cb30da360dea6364d24f970877334650216a942b4cf9b899a62f
SHA512

34845aede25d26f0ed01505a3b400996b8a1ed971d9838188acd0abe7b89a0a1dd23ea161a2705a81fe6debb47d20a2ee5e9e9679eea52636ab5e54624ac8f85
SSDEEP

1536:OBRVgrExucMBpOIfe6h8IslizXLveiVRj3QlkfYAuRPVQOSuXb3:ERRszpVe6yCfjIywL3

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1756-56-0x0000000010000000-0x0000000010017000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 1756	1016	rundll32.exe	28
PID 1016 wrote to memory of 1756	1016	rundll32.exe	28
PID 1016 wrote to memory of 1756	1016	rundll32.exe	28
PID 1016 wrote to memory of 1756	1016	rundll32.exe	28
PID 1016 wrote to memory of 1756	1016	rundll32.exe	28
PID 1016 wrote to memory of 1756	1016	rundll32.exe	28
PID 1016 wrote to memory of 1756	1016	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3ae98508522cb30da360dea6364d24f970877334650216a942b4cf9b899a62f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3ae98508522cb30da360dea6364d24f970877334650216a942b4cf9b899a62f.dll,#1
  2⤵
  PID:1756

memory/1756-55-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download
memory/1756-56-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download