e807ad58870e58f455e02370aee519774225faa304822a743e0f74f59060b089

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 13:01

Target

e807ad58870e58f455e02370aee519774225faa304822a743e0f74f59060b089.dll
Size

62KB
MD5

37559a4fcfe58d63d0fca3922ab879e2
SHA1

db91274464cbe968c5fcd222cda90caf41c66509
SHA256

e807ad58870e58f455e02370aee519774225faa304822a743e0f74f59060b089
SHA512

a8c11a37f6cf1bfd0166f7619c365131c28e12a08a80678e9eeb6a064bad3ae5505cf0909e2d429d7845424378d79cb198b12dea502f2de6f4c1a86933bb32d7
SSDEEP

1536:ltKXMx/YikoLhRCLj3NrFHWIbTttGfDKy:3hYibGXdrgkT7GfDK

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2036-59-0x00000000001B0000-0x00000000001BD000-memory.dmp	upx
behavioral1/memory/2036-60-0x00000000001B0000-0x00000000001BD000-memory.dmp	upx
behavioral1/memory/2036-56-0x00000000001B0000-0x00000000001BD000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 2036	1900	rundll32.exe	27
PID 1900 wrote to memory of 2036	1900	rundll32.exe	27
PID 1900 wrote to memory of 2036	1900	rundll32.exe	27
PID 1900 wrote to memory of 2036	1900	rundll32.exe	27
PID 1900 wrote to memory of 2036	1900	rundll32.exe	27
PID 1900 wrote to memory of 2036	1900	rundll32.exe	27
PID 1900 wrote to memory of 2036	1900	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e807ad58870e58f455e02370aee519774225faa304822a743e0f74f59060b089.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e807ad58870e58f455e02370aee519774225faa304822a743e0f74f59060b089.dll,#1
  2⤵
  PID:2036

memory/2036-55-0x0000000075131000-0x0000000075133000-memory.dmp

Filesize
8KB

Download
memory/2036-59-0x00000000001B0000-0x00000000001BD000-memory.dmp

Filesize
52KB

Download
memory/2036-60-0x00000000001B0000-0x00000000001BD000-memory.dmp

Filesize
52KB

Download
memory/2036-56-0x00000000001B0000-0x00000000001BD000-memory.dmp

Filesize
52KB

Download
memory/2036-61-0x00000000001A0000-0x00000000001A6000-memory.dmp

Filesize
24KB

Download
memory/2036-62-0x00000000001B6000-0x00000000001BC000-memory.dmp

Filesize
24KB

Download
memory/2036-63-0x00000000001B1000-0x00000000001B6000-memory.dmp

Filesize
20KB

Download