9b2f578f480726b8abe01c9243303c3d2fef70853b6f910d4d97ae95163e9537

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 23:37

Target

9b2f578f480726b8abe01c9243303c3d2fef70853b6f910d4d97ae95163e9537.dll
Size

124KB
MD5

4519ff1ae528b44b26cb13476239e5af
SHA1

662d0726ad4a90db9c305a6d5421a36baf69bc5c
SHA256

9b2f578f480726b8abe01c9243303c3d2fef70853b6f910d4d97ae95163e9537
SHA512

7cae28b3526c76b7787cbbfd635bb71bb6bde16025edb780d64a0cea0aa5a081fd48e7e6ea4188378e48802fe809a7040441d272501fa827245ffd575b398090
SSDEEP

3072:DwwpKkoo9c+nvYc2Yn25KozC+VWH39K4+m4HgIIgj+8SOlz:cwp6o9fngE2oozZVWHtFgx

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1080-56-0x0000000000310000-0x000000000036F000-memory.dmp	upx
behavioral1/memory/1080-57-0x0000000000310000-0x000000000036F000-memory.dmp	upx
behavioral1/memory/1080-58-0x0000000000310000-0x000000000036F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b2f578f480726b8abe01c9243303c3d2fef70853b6f910d4d97ae95163e9537.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b2f578f480726b8abe01c9243303c3d2fef70853b6f910d4d97ae95163e9537.dll,#1
  2⤵
  PID:1080

memory/1080-55-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download
memory/1080-56-0x0000000000310000-0x000000000036F000-memory.dmp

Filesize
380KB

Download
memory/1080-57-0x0000000000310000-0x000000000036F000-memory.dmp

Filesize
380KB

Download
memory/1080-58-0x0000000000310000-0x000000000036F000-memory.dmp

Filesize
380KB

Download