f99430bb6ae133e5ed5c172e6b4257cff5a7a16f96ede29df46d3a1a2c9bc7b0

Analysis

max time kernel
243s
max time network
334s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
07/12/2022, 03:17

Target

f99430bb6ae133e5ed5c172e6b4257cff5a7a16f96ede29df46d3a1a2c9bc7b0.dll
Size

190KB
MD5

fa49b80dd706c31e1018b3851c98f292
SHA1

07fd06344959deb46734aa2ceb4e4066beee9a80
SHA256

f99430bb6ae133e5ed5c172e6b4257cff5a7a16f96ede29df46d3a1a2c9bc7b0
SHA512

223b45b237dabb22c2505742f9aecf23b299c95e17bbd845d14b56b4dba554d5991cdaa457886ed9e25efd3a23f831399370706e0062bfadbc2fb34e3f13142f
SSDEEP

3072:jTB+AZK/xbGff7buK5qBsHgGs+pUrDLTwYo6hVOmW6kW9DGxmBgoGCDXPey:p+SKJbKWKsBsAZ+yXtH5WS9ixLoGIe

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1940-57-0x0000000010000000-0x0000000010057000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 1940	580	rundll32.exe	28
PID 580 wrote to memory of 1940	580	rundll32.exe	28
PID 580 wrote to memory of 1940	580	rundll32.exe	28
PID 580 wrote to memory of 1940	580	rundll32.exe	28
PID 580 wrote to memory of 1940	580	rundll32.exe	28
PID 580 wrote to memory of 1940	580	rundll32.exe	28
PID 580 wrote to memory of 1940	580	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f99430bb6ae133e5ed5c172e6b4257cff5a7a16f96ede29df46d3a1a2c9bc7b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f99430bb6ae133e5ed5c172e6b4257cff5a7a16f96ede29df46d3a1a2c9bc7b0.dll,#1
  2⤵
  PID:1940

memory/1940-55-0x0000000076D71000-0x0000000076D73000-memory.dmp

Filesize
8KB

Download
memory/1940-56-0x0000000000160000-0x0000000000170000-memory.dmp

Filesize
64KB

Download
memory/1940-57-0x0000000010000000-0x0000000010057000-memory.dmp

Filesize
348KB

Download