b22a2bd3c372af3369bf31be7f1564665096d7c22ae6639428fc4839779b4d68

Analysis

max time kernel
41s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 19:32

Target

b22a2bd3c372af3369bf31be7f1564665096d7c22ae6639428fc4839779b4d68.dll
Size

16KB
MD5

bb0c2ac67a3a7785fa2c88567daec780
SHA1

c7217093ba0614d6d941823fbdc315906df4a2c1
SHA256

b22a2bd3c372af3369bf31be7f1564665096d7c22ae6639428fc4839779b4d68
SHA512

07e51c28fa12d8ec0b8900aeeafde7415836b98bdc3fe05afa2ef7018f8ef90eaaa2ab687dfdfe147c6d2239fc08fed96852bd2812369cb18ca1d75237e5f792
SSDEEP

384:S9a7L+KQ6B1WiXZopmPgzXmRYElh1LB9RTlnXLRbzlib:SYW6rGpUIJmLNlXFb4b

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/856-56-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
588	856	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 856	1388	rundll32.exe	27
PID 1388 wrote to memory of 856	1388	rundll32.exe	27
PID 1388 wrote to memory of 856	1388	rundll32.exe	27
PID 1388 wrote to memory of 856	1388	rundll32.exe	27
PID 1388 wrote to memory of 856	1388	rundll32.exe	27
PID 1388 wrote to memory of 856	1388	rundll32.exe	27
PID 1388 wrote to memory of 856	1388	rundll32.exe	27
PID 856 wrote to memory of 588	856	rundll32.exe	28
PID 856 wrote to memory of 588	856	rundll32.exe	28
PID 856 wrote to memory of 588	856	rundll32.exe	28
PID 856 wrote to memory of 588	856	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b22a2bd3c372af3369bf31be7f1564665096d7c22ae6639428fc4839779b4d68.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b22a2bd3c372af3369bf31be7f1564665096d7c22ae6639428fc4839779b4d68.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 228
    3⤵
    - Program crash
    PID:588

memory/856-55-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download
memory/856-56-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download