6bafe66b59a416c4aa0786594c0281480aa7ffeac0e7261a3b821b0463c1d36b

Analysis

max time kernel
41s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 00:22

Target

6bafe66b59a416c4aa0786594c0281480aa7ffeac0e7261a3b821b0463c1d36b.dll
Size

74KB
MD5

8d43814b7f311fcc9e9cfb7a75734100
SHA1

6ec8cb199e08f14999853a5971124e8c9cd583c2
SHA256

6bafe66b59a416c4aa0786594c0281480aa7ffeac0e7261a3b821b0463c1d36b
SHA512

fcd5d6dc011148bf9c4dfd6724a492d90c9bbffbcda3bc511b88dd94b7ce800de1675d3d8360dd9937d2f911f99e23d93a0f93bf6cdd5790756eb04b6a997586
SSDEEP

1536:EK+gsidj6vPO4BQw1d/VDvF5TeM6hAQ+AHuOzLX0Z/0Bxe+PCg:ygsWj6vP3BNz7CJHuOzLU0Bk+PH

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1992-56-0x0000000010000000-0x0000000010662000-memory.dmp	upx
behavioral1/memory/1992-57-0x0000000010000000-0x0000000010662000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1992	2028	rundll32.exe	28
PID 2028 wrote to memory of 1992	2028	rundll32.exe	28
PID 2028 wrote to memory of 1992	2028	rundll32.exe	28
PID 2028 wrote to memory of 1992	2028	rundll32.exe	28
PID 2028 wrote to memory of 1992	2028	rundll32.exe	28
PID 2028 wrote to memory of 1992	2028	rundll32.exe	28
PID 2028 wrote to memory of 1992	2028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6bafe66b59a416c4aa0786594c0281480aa7ffeac0e7261a3b821b0463c1d36b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6bafe66b59a416c4aa0786594c0281480aa7ffeac0e7261a3b821b0463c1d36b.dll,#1
  2⤵
  PID:1992

memory/1992-55-0x0000000076651000-0x0000000076653000-memory.dmp

Filesize
8KB

Download
memory/1992-56-0x0000000010000000-0x0000000010662000-memory.dmp

Filesize
6.4MB

Download
memory/1992-57-0x0000000010000000-0x0000000010662000-memory.dmp

Filesize
6.4MB

Download