74229c5a46750bf414a4a15b48c66116570d772ae0949e5454cbbacac4165d83

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 21:33

Target

74229c5a46750bf414a4a15b48c66116570d772ae0949e5454cbbacac4165d83.dll
Size

72KB
MD5

e688fed53d6db88aa2f2d1dc4cd671c0
SHA1

04abf76ef9fe2f62308d87e261d0661171f1fad6
SHA256

74229c5a46750bf414a4a15b48c66116570d772ae0949e5454cbbacac4165d83
SHA512

e68114d279cd703de773f0bba3a43ef09c529c869237d405d7c899a1d4fefe1b569ad5473d9ac15e39191b9d8cf742f3d069b9b6b08d1654951ce9ece53d3279
SSDEEP

1536:wToxyT1oNr2gw/+eMpTK2LuUewpHfFFEIhmPfylFGa8P74l0LGmLj/hYL:ggq1oNrlxKXw3FZMPfkm/L5LzhYL

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/828-56-0x0000000010000000-0x000000001005B000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 828	1200	rundll32.exe	27
PID 1200 wrote to memory of 828	1200	rundll32.exe	27
PID 1200 wrote to memory of 828	1200	rundll32.exe	27
PID 1200 wrote to memory of 828	1200	rundll32.exe	27
PID 1200 wrote to memory of 828	1200	rundll32.exe	27
PID 1200 wrote to memory of 828	1200	rundll32.exe	27
PID 1200 wrote to memory of 828	1200	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74229c5a46750bf414a4a15b48c66116570d772ae0949e5454cbbacac4165d83.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\74229c5a46750bf414a4a15b48c66116570d772ae0949e5454cbbacac4165d83.dll,#1
  2⤵
  PID:828

memory/828-55-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/828-56-0x0000000010000000-0x000000001005B000-memory.dmp

Filesize
364KB

Download