77126d15c6e0449bc436216a08d7aea976c0a28c5750aad71986ef80fb8aa13f

Analysis

max time kernel
90s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 18:42

Target

77126d15c6e0449bc436216a08d7aea976c0a28c5750aad71986ef80fb8aa13f.dll
Size

114KB
MD5

ed824015707b3609ca917b4411a93c6c
SHA1

d3e7344cd7e22a2b7069e340facc086a4faa149a
SHA256

77126d15c6e0449bc436216a08d7aea976c0a28c5750aad71986ef80fb8aa13f
SHA512

2f5e9a8ea4857a797e940b05b7ac9e91beaf1e8ee08ecf15796102219d6746f5be42b5425d041ae31ee2042067ee26385e30f4f885b2a392de7cd2c10bd7f4c9
SSDEEP

3072:gfG1v4Ug1BzTQBQwUV9/jYaxO1bHToxaTxX:5gbTQBQHH/jY31bzeo

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/296-56-0x00000000001E0000-0x0000000000233000-memory.dmp	upx
behavioral1/memory/296-57-0x00000000001E0000-0x0000000000233000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 296	2028	rundll32.exe	28
PID 2028 wrote to memory of 296	2028	rundll32.exe	28
PID 2028 wrote to memory of 296	2028	rundll32.exe	28
PID 2028 wrote to memory of 296	2028	rundll32.exe	28
PID 2028 wrote to memory of 296	2028	rundll32.exe	28
PID 2028 wrote to memory of 296	2028	rundll32.exe	28
PID 2028 wrote to memory of 296	2028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\77126d15c6e0449bc436216a08d7aea976c0a28c5750aad71986ef80fb8aa13f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\77126d15c6e0449bc436216a08d7aea976c0a28c5750aad71986ef80fb8aa13f.dll,#1
  2⤵
  PID:296

memory/296-55-0x0000000076391000-0x0000000076393000-memory.dmp

Filesize
8KB

Download
memory/296-56-0x00000000001E0000-0x0000000000233000-memory.dmp

Filesize
332KB

Download
memory/296-57-0x00000000001E0000-0x0000000000233000-memory.dmp

Filesize
332KB

Download