fa09a02a6186df75b4d054e55adb9b7d68a5989496a11a5d147f64a905f4d041

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
15-10-2023 14:57

Target

9870d1d2f4772932e1b2bb68732610b0_dll32_JC.dll
Size

351KB
MD5

9870d1d2f4772932e1b2bb68732610b0
SHA1

43bbf795cbbf79476a42d261db922e9af9501cf0
SHA256

fa09a02a6186df75b4d054e55adb9b7d68a5989496a11a5d147f64a905f4d041
SHA512

6856a24a78b4671b6d571ab90c158c5b5050afab7b7b4bc3b1acf23eabd867a63e49ffa87477bd6b0cf61d508d058944bc284bfc57e97f7c9ebfb9c3618b55ea
SSDEEP

6144:8BtARd7OLgxGhZs7t/El9zO07aC1Dt3jsrRHglzY4ALjxTaiunwwzYcTpc:+tuJO5Ds7tcJOS1h3IVHglUpjQ5pc

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2040-0-0x0000000074F60000-0x000000007508C000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2040	2180	rundll32.exe	28
PID 2180 wrote to memory of 2040	2180	rundll32.exe	28
PID 2180 wrote to memory of 2040	2180	rundll32.exe	28
PID 2180 wrote to memory of 2040	2180	rundll32.exe	28
PID 2180 wrote to memory of 2040	2180	rundll32.exe	28
PID 2180 wrote to memory of 2040	2180	rundll32.exe	28
PID 2180 wrote to memory of 2040	2180	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9870d1d2f4772932e1b2bb68732610b0_dll32_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9870d1d2f4772932e1b2bb68732610b0_dll32_JC.dll,#1
  2⤵
  PID:2040

memory/2040-0-0x0000000074F60000-0x000000007508C000-memory.dmp

Filesize
1.2MB

Download
memory/2040-1-0x0000000074F60000-0x000000007508C000-memory.dmp

Filesize
1.2MB

Download