71885b4338fb150a3ec97f4a17098f92122a25518bc36ccca5b5993bbb71bda8

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
23/09/2023, 05:37

Target

71885b4338fb150a3ec97f4a17098f92122a25518bc36ccca5b5993bbb71bda8.dll
Size

1.6MB
MD5

f28192696294fa1dc19332d612bf2122
SHA1

bf1dd9910310b7914b6f92c96692b2074fd25bb2
SHA256

71885b4338fb150a3ec97f4a17098f92122a25518bc36ccca5b5993bbb71bda8
SHA512

2fb40dd8f913252024b4bf89c9fee02dd35c36d818f33d235dd8d39f58ece040e2cc010af0eabc8e838adf929ec9f9a6613445ab7b457e5c5f7b39387a2e4959
SSDEEP

24576:bq0PpSjgpQZZmJBx+g3UrxkGMmL+js+3Wvpw8x+UdNNBo44xS7LyAVnipiFVt8lO:Z0MQ3M9S+mL+Z3Wvpw8x+UPMElH3tUO

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1808-0-0x0000000010000000-0x000000001033B000-memory.dmp	upx
behavioral1/memory/1808-1-0x0000000000230000-0x000000000023B000-memory.dmp	upx
behavioral1/memory/1808-3-0x0000000010000000-0x000000001033B000-memory.dmp	upx
behavioral1/memory/1808-2-0x0000000000230000-0x000000000023B000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1808	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 1808	832	rundll32.exe	28
PID 832 wrote to memory of 1808	832	rundll32.exe	28
PID 832 wrote to memory of 1808	832	rundll32.exe	28
PID 832 wrote to memory of 1808	832	rundll32.exe	28
PID 832 wrote to memory of 1808	832	rundll32.exe	28
PID 832 wrote to memory of 1808	832	rundll32.exe	28
PID 832 wrote to memory of 1808	832	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\71885b4338fb150a3ec97f4a17098f92122a25518bc36ccca5b5993bbb71bda8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\71885b4338fb150a3ec97f4a17098f92122a25518bc36ccca5b5993bbb71bda8.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1808

memory/1808-0-0x0000000010000000-0x000000001033B000-memory.dmp

Filesize
3.2MB

Download
memory/1808-1-0x0000000000230000-0x000000000023B000-memory.dmp

Filesize
44KB

Download
memory/1808-3-0x0000000010000000-0x000000001033B000-memory.dmp

Filesize
3.2MB

Download
memory/1808-2-0x0000000000230000-0x000000000023B000-memory.dmp

Filesize
44KB

Download