ab1f99ce7da13589a9d36d074b35b04a52e5644bb1572df8416ab1c9779e5f32

Analysis

max time kernel
247s
max time network
335s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 01:47

Target

ab1f99ce7da13589a9d36d074b35b04a52e5644bb1572df8416ab1c9779e5f32.dll
Size

24KB
MD5

241ee078f732b07d076dd12507d8d340
SHA1

081580079e8d14ad22dae558237a6c2e9e1f5010
SHA256

ab1f99ce7da13589a9d36d074b35b04a52e5644bb1572df8416ab1c9779e5f32
SHA512

50dfe2e3c2773d9dd80917756a2a392fadd479cd8117044df39f8eee7f702118f3047c4c1984087b78f79946fb883d96c0226575691c41857b4a18b0fdeb98a9
SSDEEP

384:eEbw0DUljmXE+UT41rs/zsienJIgeOuXrjdVmSaAbPRrlZ8JTcvD/:eEbwoURHYA4J4drXdlPRrIJTcL

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1532-56-0x0000000010000000-0x0000000010012000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 268 wrote to memory of 1532	268	rundll32.exe	28
PID 268 wrote to memory of 1532	268	rundll32.exe	28
PID 268 wrote to memory of 1532	268	rundll32.exe	28
PID 268 wrote to memory of 1532	268	rundll32.exe	28
PID 268 wrote to memory of 1532	268	rundll32.exe	28
PID 268 wrote to memory of 1532	268	rundll32.exe	28
PID 268 wrote to memory of 1532	268	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab1f99ce7da13589a9d36d074b35b04a52e5644bb1572df8416ab1c9779e5f32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab1f99ce7da13589a9d36d074b35b04a52e5644bb1572df8416ab1c9779e5f32.dll,#1
  2⤵
  PID:1532

memory/1532-54-0x0000000000000000-mapping.dmp

Download
memory/1532-55-0x0000000074ED1000-0x0000000074ED3000-memory.dmp

Filesize
8KB

Download
memory/1532-56-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download