7a0a403ed5f196a851e4d0d6cdec48f9378a70c71df1b812742109951289a2ec

Analysis

max time kernel
59s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 19:33

Target

7a0a403ed5f196a851e4d0d6cdec48f9378a70c71df1b812742109951289a2ec.dll
Size

16KB
MD5

0f57b4a0d87b18cbb14651ac956b8180
SHA1

d9e5cd3076a6e39c3267584a4f5b25719b08db5a
SHA256

7a0a403ed5f196a851e4d0d6cdec48f9378a70c71df1b812742109951289a2ec
SHA512

a51c8c5232ee96e8478e33a3e7cf90ea3a91a6375c9fedc1d834aea07577dea64c07c547181bd0a39ced1718040d2c561c56d7b8bbab7464132894f38e583b45
SSDEEP

384:S9a7L+KQ6B1WiXZopmPgzXmRYElh1LB9RTlnXLRbzlC:SYW6rGpUIJmLNlXFbI

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/592-57-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1552	592	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 592	956	rundll32.exe	28
PID 956 wrote to memory of 592	956	rundll32.exe	28
PID 956 wrote to memory of 592	956	rundll32.exe	28
PID 956 wrote to memory of 592	956	rundll32.exe	28
PID 956 wrote to memory of 592	956	rundll32.exe	28
PID 956 wrote to memory of 592	956	rundll32.exe	28
PID 956 wrote to memory of 592	956	rundll32.exe	28
PID 592 wrote to memory of 1552	592	rundll32.exe	29
PID 592 wrote to memory of 1552	592	rundll32.exe	29
PID 592 wrote to memory of 1552	592	rundll32.exe	29
PID 592 wrote to memory of 1552	592	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a0a403ed5f196a851e4d0d6cdec48f9378a70c71df1b812742109951289a2ec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a0a403ed5f196a851e4d0d6cdec48f9378a70c71df1b812742109951289a2ec.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 592 -s 228
    3⤵
    - Program crash
    PID:1552

memory/592-55-0x0000000075761000-0x0000000075763000-memory.dmp

Filesize
8KB

Download
memory/592-57-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download