f8f73da3a552be3022e7aa6538d31f43d6b410d6083cf48a895f408df660a89e

Analysis

max time kernel
41s
max time network
132s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 12:05

Target

f8f73da3a552be3022e7aa6538d31f43d6b410d6083cf48a895f408df660a89e.dll
Size

21KB
MD5

0ce143cda2bb97b2b00c840a9b8b71d8
SHA1

cd05b365ca0b6d6b9ad25f9180cbc35ef6b369c7
SHA256

f8f73da3a552be3022e7aa6538d31f43d6b410d6083cf48a895f408df660a89e
SHA512

f2f447db3763228b23c4485434905ddb8e52d8906a8ef781c4127f3360abff5f74406b07e6efba5fbf37c039c2bb1424a95971db082329f7c53830481e9dfb0d
SSDEEP

384:9w2fzhxC+iyYBx6jJejpTymN6TrydVuNN9fGFDnjkMcRfEVn4pLhd+pvq1n:621xCXhx6YjV6XwVo+F7wRfWELhdwq

Score

8^/10

upx

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	896	rundll32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/896-56-0x0000000071000000-0x0000000071019000-memory.dmp	upx
behavioral1/memory/896-57-0x0000000071000000-0x0000000071019000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\smss.dll	rundll32.exe
File created	C:\Windows\SysWOW64\WLanAdapter.sys	rundll32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
468	Process not Found

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 896	1084	rundll32.exe	27
PID 1084 wrote to memory of 896	1084	rundll32.exe	27
PID 1084 wrote to memory of 896	1084	rundll32.exe	27
PID 1084 wrote to memory of 896	1084	rundll32.exe	27
PID 1084 wrote to memory of 896	1084	rundll32.exe	27
PID 1084 wrote to memory of 896	1084	rundll32.exe	27
PID 1084 wrote to memory of 896	1084	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8f73da3a552be3022e7aa6538d31f43d6b410d6083cf48a895f408df660a89e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8f73da3a552be3022e7aa6538d31f43d6b410d6083cf48a895f408df660a89e.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:896

memory/896-55-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download
memory/896-56-0x0000000071000000-0x0000000071019000-memory.dmp

Filesize
100KB

Download
memory/896-57-0x0000000071000000-0x0000000071019000-memory.dmp

Filesize
100KB

Download