fc044b806f4fb099c5b3ae4b2a222ae559e424c38729c4799d3d658e30a66c93

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 00:58

Target

fc044b806f4fb099c5b3ae4b2a222ae559e424c38729c4799d3d658e30a66c93.dll
Size

16KB
MD5

07fb2ca3a520bae459b81cab34875f70
SHA1

bbb7e8ee407002583fa6da7655c87a9acca23862
SHA256

fc044b806f4fb099c5b3ae4b2a222ae559e424c38729c4799d3d658e30a66c93
SHA512

90a5814007083b15c1a3f35036d00bfdf063aaf3c321342dd4003be9a2bacd5fcc6bc08c1d4ade2bc83a6ba7aa9d8af6329c5cd2271a427109d92c0ff4934818
SSDEEP

384:Eg/9m7f9OzuPlMco4F5hAK8gAEOK4/vGzpSApB:KfAzBco0TAK8dEVSvGzzj

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/304-56-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/304-57-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 304	1572	rundll32.exe	27
PID 1572 wrote to memory of 304	1572	rundll32.exe	27
PID 1572 wrote to memory of 304	1572	rundll32.exe	27
PID 1572 wrote to memory of 304	1572	rundll32.exe	27
PID 1572 wrote to memory of 304	1572	rundll32.exe	27
PID 1572 wrote to memory of 304	1572	rundll32.exe	27
PID 1572 wrote to memory of 304	1572	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc044b806f4fb099c5b3ae4b2a222ae559e424c38729c4799d3d658e30a66c93.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc044b806f4fb099c5b3ae4b2a222ae559e424c38729c4799d3d658e30a66c93.dll,#1
  2⤵
  PID:304

memory/304-55-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/304-56-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/304-57-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download