a43572dd5ec406c32b9b42114963a2b6fad0d7a5baa160d580d8c49c42ceeb92

Analysis

max time kernel
45s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 10:14

Target

a43572dd5ec406c32b9b42114963a2b6fad0d7a5baa160d580d8c49c42ceeb92.dll
Size

216KB
MD5

c762b7744db90ba0ed2a7019f0d0fcee
SHA1

e32a0db357e504ec386f12d923d25381f13f90c3
SHA256

a43572dd5ec406c32b9b42114963a2b6fad0d7a5baa160d580d8c49c42ceeb92
SHA512

e5efe4fd524d0e2b2302b56dd81ab7c966a6292076c0cb6fbc443a0afce683080269e4aa22ce9c2cde8f8c50c4f4f30d0a316381f3f275b34f552531c0c0552a
SSDEEP

384:tmDv+CVrphJmXh+eAsgQLlR6WkopVOm67fbCy6V:ADWCVrAXVCwkomXC

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1788-56-0x0000000010000000-0x0000000010011000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1788	1732	rundll32.exe	27
PID 1732 wrote to memory of 1788	1732	rundll32.exe	27
PID 1732 wrote to memory of 1788	1732	rundll32.exe	27
PID 1732 wrote to memory of 1788	1732	rundll32.exe	27
PID 1732 wrote to memory of 1788	1732	rundll32.exe	27
PID 1732 wrote to memory of 1788	1732	rundll32.exe	27
PID 1732 wrote to memory of 1788	1732	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a43572dd5ec406c32b9b42114963a2b6fad0d7a5baa160d580d8c49c42ceeb92.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a43572dd5ec406c32b9b42114963a2b6fad0d7a5baa160d580d8c49c42ceeb92.dll,#1
  2⤵
  PID:1788

memory/1788-55-0x0000000075771000-0x0000000075773000-memory.dmp

Filesize
8KB

Download
memory/1788-56-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download