7ba49ca59c81cf30fc9455e0ce4050c202edb68ef6d1bf4df06e6ecb815f69c2

Analysis

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 12:01

Target

7ba49ca59c81cf30fc9455e0ce4050c202edb68ef6d1bf4df06e6ecb815f69c2.dll
Size

16KB
MD5

9b4ce259123f2826292c2ed47b642820
SHA1

34de2c137f0a19ea4db301964ff2070a61ac9b33
SHA256

7ba49ca59c81cf30fc9455e0ce4050c202edb68ef6d1bf4df06e6ecb815f69c2
SHA512

f579f0d8dacec66a875fa73c2dff5b1b049221982c631c2397d2c9ea78def5bba47fd83d0477d6c486586646834e417d20db1bee7372026a67f85fe74fd096e7
SSDEEP

384:Eg/9m7f9OzuPlMco4F5hAK8gAEOK4/vGzpSApwy:KfAzBco0TAK8dEVSvGzzuy

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1312-133-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1312-134-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 1312	1192	rundll32.exe	76
PID 1192 wrote to memory of 1312	1192	rundll32.exe	76
PID 1192 wrote to memory of 1312	1192	rundll32.exe	76

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ba49ca59c81cf30fc9455e0ce4050c202edb68ef6d1bf4df06e6ecb815f69c2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ba49ca59c81cf30fc9455e0ce4050c202edb68ef6d1bf4df06e6ecb815f69c2.dll,#1
  2⤵
  PID:1312

memory/1312-133-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1312-134-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download