7d863812d391f84ed8cc8309e51ca86770d176b9ba06d5180304c4b97d871bab

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 01:21

Target

7d863812d391f84ed8cc8309e51ca86770d176b9ba06d5180304c4b97d871bab.dll
Size

4KB
MD5

973ba4999a7610c6478d39046d3121b0
SHA1

d96779be207cbb2ae408f2a4aad651334acf4820
SHA256

7d863812d391f84ed8cc8309e51ca86770d176b9ba06d5180304c4b97d871bab
SHA512

efa71f7712e55124550c291dd292e8d7109666aff68926913d2feedf1b54cca8b725b76b9034ea5cef4213d8c72a61364bb64a6dba895c4b6030758b3a59a5ec
SSDEEP

48:a5zuMqBcq06phM/wwWLSeJY8JTa6Il+LO3HITIhUcizrAP3widqhmbUs+UH+:TRphMzf8O3Z6ciQ/tVbco+

Score

9^/10

upx

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/memory/1168-57-0x0000000075360000-0x0000000075368000-memory.dmp	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1168-57-0x0000000075360000-0x0000000075368000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 1168	1832	rundll32.exe	27
PID 1832 wrote to memory of 1168	1832	rundll32.exe	27
PID 1832 wrote to memory of 1168	1832	rundll32.exe	27
PID 1832 wrote to memory of 1168	1832	rundll32.exe	27
PID 1832 wrote to memory of 1168	1832	rundll32.exe	27
PID 1832 wrote to memory of 1168	1832	rundll32.exe	27
PID 1832 wrote to memory of 1168	1832	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d863812d391f84ed8cc8309e51ca86770d176b9ba06d5180304c4b97d871bab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d863812d391f84ed8cc8309e51ca86770d176b9ba06d5180304c4b97d871bab.dll,#1
  2⤵
  PID:1168

memory/1168-54-0x0000000000000000-mapping.dmp

Download
memory/1168-55-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download
memory/1168-56-0x0000000075370000-0x0000000075378000-memory.dmp

Filesize
32KB

Download
memory/1168-57-0x0000000075360000-0x0000000075368000-memory.dmp

Filesize
32KB

Download