981ba48b765812ed1d6398b84696821e04ae472468e5b8bfd904ddd0737db57d

Analysis

max time kernel
47s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 16:49

Target

981ba48b765812ed1d6398b84696821e04ae472468e5b8bfd904ddd0737db57d.dll
Size

314KB
MD5

682ab0335c8ceb4ee4035494c3b077c2
SHA1

79b15adb64d4a3e7eff68b3272915721d0d5f550
SHA256

981ba48b765812ed1d6398b84696821e04ae472468e5b8bfd904ddd0737db57d
SHA512

dccfbced47ee90fcee7012f274d539eec89b5963cb08081ab78a5fdbbc3a1d101a735609886afd400cd2ecff29447f35c659a6db35f518f43200d5d09fadc5df
SSDEEP

6144:DYOS2yKcIsoZoilr1ZL/C1qU66BWdbKj6OCwaWORQNE+EC2PUJvjjlBP:UfExXKcU6LWPlOR1Cw2v/lN

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/936-56-0x0000000001BF0000-0x0000000001CD4000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 936	956	rundll32.exe	28
PID 956 wrote to memory of 936	956	rundll32.exe	28
PID 956 wrote to memory of 936	956	rundll32.exe	28
PID 956 wrote to memory of 936	956	rundll32.exe	28
PID 956 wrote to memory of 936	956	rundll32.exe	28
PID 956 wrote to memory of 936	956	rundll32.exe	28
PID 956 wrote to memory of 936	956	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\981ba48b765812ed1d6398b84696821e04ae472468e5b8bfd904ddd0737db57d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\981ba48b765812ed1d6398b84696821e04ae472468e5b8bfd904ddd0737db57d.dll,#1
  2⤵
  PID:936

memory/936-55-0x00000000760A1000-0x00000000760A3000-memory.dmp

Filesize
8KB

Download
memory/936-56-0x0000000001BF0000-0x0000000001CD4000-memory.dmp

Filesize
912KB

Download