e4aa2589e2fd8c77fc9220d36ec8e78ba674d33c10389bbdc883f157d8982aef

Analysis

max time kernel
17s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 00:31

Target

e4aa2589e2fd8c77fc9220d36ec8e78ba674d33c10389bbdc883f157d8982aef.dll
Size

73KB
MD5

8ba65a940f812f416d433bc1e4d818b0
SHA1

b319ae83b6f3097350b6cac76e78a9cdc34db731
SHA256

e4aa2589e2fd8c77fc9220d36ec8e78ba674d33c10389bbdc883f157d8982aef
SHA512

5733b90ce4b92aaab9ec942fdd691d0d055b6959782e9d2dfe73c5f50026c517cb492345fe67103d37c534be5bd796c28750bf35efc83c64114f895efc05a403
SSDEEP

1536:agF0eiyUcbdegnmYolNFav6JHUzcS2rMle45oPOvNosq5aZsKvTlMtOWd0kp6CZY:t2yFBegrolNF06IdVe16NfRsKvKtOUPC

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1128-56-0x0000000010000000-0x0000000010011000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 1128	1256	rundll32.exe	28
PID 1256 wrote to memory of 1128	1256	rundll32.exe	28
PID 1256 wrote to memory of 1128	1256	rundll32.exe	28
PID 1256 wrote to memory of 1128	1256	rundll32.exe	28
PID 1256 wrote to memory of 1128	1256	rundll32.exe	28
PID 1256 wrote to memory of 1128	1256	rundll32.exe	28
PID 1256 wrote to memory of 1128	1256	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e4aa2589e2fd8c77fc9220d36ec8e78ba674d33c10389bbdc883f157d8982aef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e4aa2589e2fd8c77fc9220d36ec8e78ba674d33c10389bbdc883f157d8982aef.dll,#1
  2⤵
  PID:1128

memory/1128-55-0x0000000076531000-0x0000000076533000-memory.dmp

Filesize
8KB

Download
memory/1128-56-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/1128-57-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/1128-58-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download