bd08dc465843f1173f0895d14cfa9b6fb61ca036d68d074acb53d076ad8a796e

Analysis

max time kernel
41s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 06:13

Target

bd08dc465843f1173f0895d14cfa9b6fb61ca036d68d074acb53d076ad8a796e.dll
Size

148KB
MD5

aa846b78a66c640388a0d835a8f95550
SHA1

19f01d78f400048b3a47ec6ccd0395e0913d3577
SHA256

bd08dc465843f1173f0895d14cfa9b6fb61ca036d68d074acb53d076ad8a796e
SHA512

96af12d971c8299968b7266fac4c83a415fc881eefd19e525bea39bb8ce061918341a2b575f51299ebc5a9b802c85f5ba8290a4ae4904ff0ab45cff09ccc7db3
SSDEEP

3072:OdJrDIYNcf6Ys0bboG9SnQCa1ePvwttNiL064m0h+Z6v9XCdQx0:OEYNcf643gTvwttUL064m0hhsdK

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1728-56-0x0000000000100000-0x000000000010E000-memory.dmp	upx
behavioral1/memory/1728-59-0x0000000000100000-0x000000000010E000-memory.dmp	upx
behavioral1/memory/1728-60-0x0000000000100000-0x000000000010E000-memory.dmp	upx

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\EV_HMAC_SISO_40M - m_RxMax AgcParams.m_RxDelay: up faileA	rundll32.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\CEA-861B:#2	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 1728	1812	rundll32.exe	28
PID 1812 wrote to memory of 1728	1812	rundll32.exe	28
PID 1812 wrote to memory of 1728	1812	rundll32.exe	28
PID 1812 wrote to memory of 1728	1812	rundll32.exe	28
PID 1812 wrote to memory of 1728	1812	rundll32.exe	28
PID 1812 wrote to memory of 1728	1812	rundll32.exe	28
PID 1812 wrote to memory of 1728	1812	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd08dc465843f1173f0895d14cfa9b6fb61ca036d68d074acb53d076ad8a796e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd08dc465843f1173f0895d14cfa9b6fb61ca036d68d074acb53d076ad8a796e.dll,#1
  2⤵
  - NTFS ADS
  PID:1728

memory/1728-55-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download
memory/1728-56-0x0000000000100000-0x000000000010E000-memory.dmp

Filesize
56KB

Download
memory/1728-59-0x0000000000100000-0x000000000010E000-memory.dmp

Filesize
56KB

Download
memory/1728-60-0x0000000000100000-0x000000000010E000-memory.dmp

Filesize
56KB

Download
memory/1728-62-0x0000000000107000-0x000000000010D000-memory.dmp

Filesize
24KB

Download
memory/1728-61-0x00000000000F0000-0x00000000000F8000-memory.dmp

Filesize
32KB

Download
memory/1728-63-0x0000000000101000-0x0000000000107000-memory.dmp

Filesize
24KB

Download