746de24d0bae15ea91f87723f60f54bd8819180eb50010d3025054b8c38f72a2

Analysis

max time kernel
20s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 09:31

Target

746de24d0bae15ea91f87723f60f54bd8819180eb50010d3025054b8c38f72a2.dll
Size

109KB
MD5

7b91e4439c6d20654603f03519cf6d1d
SHA1

fb66493cf5051d6dedbd1403c4b156f1df8099b7
SHA256

746de24d0bae15ea91f87723f60f54bd8819180eb50010d3025054b8c38f72a2
SHA512

a1541689ce56062dcdb4e032b22754dd896fb1b6464d1e0cb86374144cb4adabcfabfb5a3c7f3d6c0f9dd01c6381e8dc899faf1a4f4bba270ad9e30c44f5837d
SSDEEP

3072:nKBqNGliGdtLiHKiwj2umC4ytsaydl+GO:sWGg+2qiwWhJ8

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1176-56-0x0000000010000000-0x0000000010044000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1176	1704	rundll32.exe	28
PID 1704 wrote to memory of 1176	1704	rundll32.exe	28
PID 1704 wrote to memory of 1176	1704	rundll32.exe	28
PID 1704 wrote to memory of 1176	1704	rundll32.exe	28
PID 1704 wrote to memory of 1176	1704	rundll32.exe	28
PID 1704 wrote to memory of 1176	1704	rundll32.exe	28
PID 1704 wrote to memory of 1176	1704	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\746de24d0bae15ea91f87723f60f54bd8819180eb50010d3025054b8c38f72a2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\746de24d0bae15ea91f87723f60f54bd8819180eb50010d3025054b8c38f72a2.dll,#1
  2⤵
  PID:1176

memory/1176-55-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download
memory/1176-56-0x0000000010000000-0x0000000010044000-memory.dmp

Filesize
272KB

Download