cf0e34a93e7474ec3fdd752edf3205efe6e75459571b1b321c0f344d0e53a6c7

Analysis

max time kernel
53s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 20:33

Target

cf0e34a93e7474ec3fdd752edf3205efe6e75459571b1b321c0f344d0e53a6c7.dll
Size

56KB
MD5

5a1b5e14be335bc4a4ea60318c41c3c0
SHA1

ef7f9faae5670cec3239cdd79be4769d9f23c51b
SHA256

cf0e34a93e7474ec3fdd752edf3205efe6e75459571b1b321c0f344d0e53a6c7
SHA512

67ff033384870883ce21f065deda6376a4c4866da64414ede07306e71228f1eaa8bf10db244de32ef03892b9c1a79b268125aedb46face7156b4e585111cff78
SSDEEP

768:yuUr3ip/IHI7NQTvSggmUDRxRJvWuN3MEQEAzuc0oSF5JPSSFkdMSQipG4yT4pev:yl3E0Tb7onJvWuN8+cdMBSSQJe8i

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2036-56-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2036	1740	rundll32.exe	28
PID 1740 wrote to memory of 2036	1740	rundll32.exe	28
PID 1740 wrote to memory of 2036	1740	rundll32.exe	28
PID 1740 wrote to memory of 2036	1740	rundll32.exe	28
PID 1740 wrote to memory of 2036	1740	rundll32.exe	28
PID 1740 wrote to memory of 2036	1740	rundll32.exe	28
PID 1740 wrote to memory of 2036	1740	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf0e34a93e7474ec3fdd752edf3205efe6e75459571b1b321c0f344d0e53a6c7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf0e34a93e7474ec3fdd752edf3205efe6e75459571b1b321c0f344d0e53a6c7.dll,#1
  2⤵
  PID:2036

memory/2036-55-0x0000000076531000-0x0000000076533000-memory.dmp

Filesize
8KB

Download
memory/2036-56-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download