a033c8b8d48356414c5f4cce9280465c23bb47bcd65dc6fee8fb043826388062

Analysis

max time kernel
122s
max time network
154s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:11

Target

HJBMP3.dll
Size

44KB
MD5

4e94782516d83739d4b0d63a10d9954a
SHA1

75bdcbd07e11effe36b2154439832e608a58a6ce
SHA256

e803d23e480cfc17ec188000782870d8071d49653a00925c8535cc86af278fe6
SHA512

26856b1a36f8a9ecb0d2c1aa4c06e59d692225d7d4c1b7a514afa615f498e7b9b0705e8db7929edec7eb2ebbf2c89c2dadd0c3604db8ab52ec082a0b2ef10367
SSDEEP

768:JsFMoOiSFUrsN6s3VEd9tHXv927UZpUZscx8+Obb8Gl2hArMU81v+fD/:JsO3VMsN64qd9tH8UZpUpobGmNNf

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral3/memory/2628-1-0x0000000010000000-0x0000000010035000-memory.dmp	upx
behavioral3/memory/2628-2-0x0000000010000000-0x0000000010035000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2628	2756	rundll32.exe	28
PID 2756 wrote to memory of 2628	2756	rundll32.exe	28
PID 2756 wrote to memory of 2628	2756	rundll32.exe	28
PID 2756 wrote to memory of 2628	2756	rundll32.exe	28
PID 2756 wrote to memory of 2628	2756	rundll32.exe	28
PID 2756 wrote to memory of 2628	2756	rundll32.exe	28
PID 2756 wrote to memory of 2628	2756	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HJBMP3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\HJBMP3.dll,#1
  2⤵
  PID:2628

memory/2628-0-0x0000000010000000-0x0000000010035000-memory.dmp

Filesize
212KB

Download
memory/2628-1-0x0000000010000000-0x0000000010035000-memory.dmp

Filesize
212KB

Download
memory/2628-2-0x0000000010000000-0x0000000010035000-memory.dmp

Filesize
212KB

Download
memory/2628-3-0x0000000010000000-0x0000000010035000-memory.dmp

Filesize
212KB

Download
memory/2628-4-0x0000000010000000-0x0000000010035000-memory.dmp

Filesize
212KB

Download