aa6e3a3f06fbf1a9b6fd3c03afd97abb83adcaa63e68bf41e83fe0ff2aff02e1

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 23:30

Target

AutoGuarder2.3.7.350/Vdata.dll
Size

292KB
MD5

de79e4c838a1dcf3f3d54eab5fc63681
SHA1

ac447f0655f4554813b749cf897ac295880696f1
SHA256

32a642a8da1dc91a23da73034667450cf93027c9d97e21a598d818cc04fb925c
SHA512

83c73f8cd8910f130cea396ad273c429f6fd8ed55b39cd6e72d67ee6ecf439d53b1591591cb0481141afe1daa4fe544a209b06c568c5903b5a7f34fcbb8a58af
SSDEEP

3072:txWd0it/JuCt7HBI0EVSdQq4gc9TgkCAzrK1FwWmLPiKMe0RzTK0cpH2aNDyhYmP:uSitPBnZdQqtcgurAou1edHC+rrXRw/

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral7/memory/2524-0-0x0000000010000000-0x0000000010215000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 2524	1488	rundll32.exe	30
PID 1488 wrote to memory of 2524	1488	rundll32.exe	30
PID 1488 wrote to memory of 2524	1488	rundll32.exe	30
PID 1488 wrote to memory of 2524	1488	rundll32.exe	30
PID 1488 wrote to memory of 2524	1488	rundll32.exe	30
PID 1488 wrote to memory of 2524	1488	rundll32.exe	30
PID 1488 wrote to memory of 2524	1488	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AutoGuarder2.3.7.350\Vdata.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AutoGuarder2.3.7.350\Vdata.dll,#1
  2⤵
  PID:2524

memory/2524-0-0x0000000010000000-0x0000000010215000-memory.dmp

Filesize
2.1MB

Download
memory/2524-1-0x0000000010000000-0x0000000010215000-memory.dmp

Filesize
2.1MB

Download