1436837ffca0ae14a4a78094712bde49fe4aa056cdba9885d4980863cebc139b

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 03:17

Target

59b08c0c6e8516d65a7a8bd02bce6bb6.dll
Size

364KB
MD5

59b08c0c6e8516d65a7a8bd02bce6bb6
SHA1

1a0226539a35acc482c58c8488f0ba26c369dd85
SHA256

1436837ffca0ae14a4a78094712bde49fe4aa056cdba9885d4980863cebc139b
SHA512

8dee8cc06b33986a3aab8c75bf871c9c13041a36f29ccb4574588958213db92dcb747b19b2c87a653b30683ed99a658fa73512600c344a97d182f30365c13245
SSDEEP

6144:SUAJ+OOYy2gFf3wdoV6bewJAC+KjWN+fAPA25NmbLTtVpoRN6iPHZep4++c:pAJSJbyoVuewC7KjWN+fAPbDSkwKep

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1984-2-0x00000000746F0000-0x000000007475D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 1984	1152	rundll32.exe	10
PID 1152 wrote to memory of 1984	1152	rundll32.exe	10
PID 1152 wrote to memory of 1984	1152	rundll32.exe	10
PID 1152 wrote to memory of 1984	1152	rundll32.exe	10
PID 1152 wrote to memory of 1984	1152	rundll32.exe	10
PID 1152 wrote to memory of 1984	1152	rundll32.exe	10
PID 1152 wrote to memory of 1984	1152	rundll32.exe	10

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59b08c0c6e8516d65a7a8bd02bce6bb6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59b08c0c6e8516d65a7a8bd02bce6bb6.dll,#1
  2⤵
  PID:1984

memory/1984-0-0x0000000074760000-0x00000000747CD000-memory.dmp

Filesize
436KB

Download
memory/1984-1-0x00000000746D0000-0x000000007473D000-memory.dmp

Filesize
436KB

Download
memory/1984-2-0x00000000746F0000-0x000000007475D000-memory.dmp

Filesize
436KB

Download