bca1e0b4d43921390bdfdd1bb08b9a62152ccfd6d852d77b81e613fd17753d65

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 01:31

Target

bca1e0b4d43921390bdfdd1bb08b9a62152ccfd6d852d77b81e613fd17753d65.dll
Size

63KB
MD5

5ea9bb51266236215d9fc357bb3c3a2d
SHA1

0500f880969b74ca30e103a8e2a5c3603d99b585
SHA256

bca1e0b4d43921390bdfdd1bb08b9a62152ccfd6d852d77b81e613fd17753d65
SHA512

e75ad756a9c1ddf110bed480fcae6fd4e6010dfc03709f01578d5967cb8ed5f6a73ae89d705ef9f9161c7add3acdd40c1fedc946f109f7d11e3fd165e2a732d6
SSDEEP

1536:1zExMwCGQ2j9WXiqIWej6+jCF94q6DijvO8G:1I+wCGvwSqIWyjCV6QdG

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1172-56-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 1172	1824	rundll32.exe	27
PID 1824 wrote to memory of 1172	1824	rundll32.exe	27
PID 1824 wrote to memory of 1172	1824	rundll32.exe	27
PID 1824 wrote to memory of 1172	1824	rundll32.exe	27
PID 1824 wrote to memory of 1172	1824	rundll32.exe	27
PID 1824 wrote to memory of 1172	1824	rundll32.exe	27
PID 1824 wrote to memory of 1172	1824	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bca1e0b4d43921390bdfdd1bb08b9a62152ccfd6d852d77b81e613fd17753d65.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bca1e0b4d43921390bdfdd1bb08b9a62152ccfd6d852d77b81e613fd17753d65.dll,#1
  2⤵
  PID:1172

memory/1172-55-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download
memory/1172-56-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download