e7f9da1f714f4fd985b3e073d9e79c54326fda7c820c4a483ca9542cb5bd4de6

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 13:02

Target

e7f9da1f714f4fd985b3e073d9e79c54326fda7c820c4a483ca9542cb5bd4de6.dll
Size

947KB
MD5

0c00cb91b766562b265e79b12a2efa3a
SHA1

06813041c1a6351d5ddb49f2acfca5966e0c3982
SHA256

e7f9da1f714f4fd985b3e073d9e79c54326fda7c820c4a483ca9542cb5bd4de6
SHA512

62fe097efbfc6aaee1c6bb15a95116e82421611ad7760c5f8ccc389a35d5a9c82d999047c46980c9105674ce161b17b368402ae570f1c2e0433c23f8a8e1dab5
SSDEEP

24576:txlOpjL3Y/pSskHKGb7TIh31e0EG+PlZ+y+imz1:1snoBSskqGb7TIZ1e0E1z+5

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1568-56-0x0000000001CB0000-0x0000000001F95000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 1568	968	rundll32.exe	27
PID 968 wrote to memory of 1568	968	rundll32.exe	27
PID 968 wrote to memory of 1568	968	rundll32.exe	27
PID 968 wrote to memory of 1568	968	rundll32.exe	27
PID 968 wrote to memory of 1568	968	rundll32.exe	27
PID 968 wrote to memory of 1568	968	rundll32.exe	27
PID 968 wrote to memory of 1568	968	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e7f9da1f714f4fd985b3e073d9e79c54326fda7c820c4a483ca9542cb5bd4de6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e7f9da1f714f4fd985b3e073d9e79c54326fda7c820c4a483ca9542cb5bd4de6.dll,#1
  2⤵
  PID:1568

memory/1568-55-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download
memory/1568-56-0x0000000001CB0000-0x0000000001F95000-memory.dmp

Filesize
2.9MB

Download
memory/1568-57-0x0000000001CB0000-0x0000000001F95000-memory.dmp

Filesize
2.9MB

Download
memory/1568-58-0x0000000001CB0000-0x0000000001F95000-memory.dmp

Filesize
2.9MB

Download
memory/1568-59-0x0000000000290000-0x0000000000294000-memory.dmp

Filesize
16KB

Download