7ba49ca59c81cf30fc9455e0ce4050c202edb68ef6d1bf4df06e6ecb815f69c2

Analysis

max time kernel
230s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 12:01

Target

7ba49ca59c81cf30fc9455e0ce4050c202edb68ef6d1bf4df06e6ecb815f69c2.dll
Size

16KB
MD5

9b4ce259123f2826292c2ed47b642820
SHA1

34de2c137f0a19ea4db301964ff2070a61ac9b33
SHA256

7ba49ca59c81cf30fc9455e0ce4050c202edb68ef6d1bf4df06e6ecb815f69c2
SHA512

f579f0d8dacec66a875fa73c2dff5b1b049221982c631c2397d2c9ea78def5bba47fd83d0477d6c486586646834e417d20db1bee7372026a67f85fe74fd096e7
SSDEEP

384:Eg/9m7f9OzuPlMco4F5hAK8gAEOK4/vGzpSApwy:KfAzBco0TAK8dEVSvGzzuy

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/468-56-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/468-57-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 468	564	rundll32.exe	28
PID 564 wrote to memory of 468	564	rundll32.exe	28
PID 564 wrote to memory of 468	564	rundll32.exe	28
PID 564 wrote to memory of 468	564	rundll32.exe	28
PID 564 wrote to memory of 468	564	rundll32.exe	28
PID 564 wrote to memory of 468	564	rundll32.exe	28
PID 564 wrote to memory of 468	564	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ba49ca59c81cf30fc9455e0ce4050c202edb68ef6d1bf4df06e6ecb815f69c2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ba49ca59c81cf30fc9455e0ce4050c202edb68ef6d1bf4df06e6ecb815f69c2.dll,#1
  2⤵
  PID:468

memory/468-55-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/468-56-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/468-57-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download