c4e401581c72710f14189a50adda86e81ec3a8c6dfbe08ccc90c60309c02449f

Analysis

max time kernel
4s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 06:30

Target

c4e401581c72710f14189a50adda86e81ec3a8c6dfbe08ccc90c60309c02449f.dll
Size

121KB
MD5

2c906c39de5e77407d88c84ed71aa94b
SHA1

287e868e12e88b25020d9d9f4ec0b830ef432dcd
SHA256

c4e401581c72710f14189a50adda86e81ec3a8c6dfbe08ccc90c60309c02449f
SHA512

3168a8cbbd3261d0685017d20b79d50b808e0ca185d4b80967cb4631d2563897c2da0730004bee07c7a7d14bd33d112365f12fe69eaa9205a53be5f99a44496b
SSDEEP

1536:rBOCyr54X7Bq1NZrxiQCwGIjEdw0EsE8+e/izUpMu32iGTSmWCVteEjnPOuzA+r2:uW7BqtrbFGsn0aU1aA8t3TZAud4

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1900-58-0x0000000000440000-0x000000000048B000-memory.dmp	upx
behavioral1/memory/1900-60-0x0000000000440000-0x000000000048B000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 1900	892	rundll32.exe	27
PID 892 wrote to memory of 1900	892	rundll32.exe	27
PID 892 wrote to memory of 1900	892	rundll32.exe	27
PID 892 wrote to memory of 1900	892	rundll32.exe	27
PID 892 wrote to memory of 1900	892	rundll32.exe	27
PID 892 wrote to memory of 1900	892	rundll32.exe	27
PID 892 wrote to memory of 1900	892	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c4e401581c72710f14189a50adda86e81ec3a8c6dfbe08ccc90c60309c02449f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c4e401581c72710f14189a50adda86e81ec3a8c6dfbe08ccc90c60309c02449f.dll,#1
  2⤵
  PID:1900

memory/1900-55-0x0000000075131000-0x0000000075133000-memory.dmp

Filesize
8KB

Download
memory/1900-56-0x0000000000280000-0x00000000002CE000-memory.dmp

Filesize
312KB

Download
memory/1900-58-0x0000000000440000-0x000000000048B000-memory.dmp

Filesize
300KB

Download
memory/1900-59-0x0000000000280000-0x00000000002CE000-memory.dmp

Filesize
312KB

Download
memory/1900-60-0x0000000000440000-0x000000000048B000-memory.dmp

Filesize
300KB

Download