4040003f1c2e98555506444cc8ac2d47c529fb3b119b649d70589557b7fea428

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 04:50

Target

681829f54228f96eba60ecec070f6a13.dll
Size

44KB
MD5

681829f54228f96eba60ecec070f6a13
SHA1

e5d6b65ec4c34fb587b055526cda0b635d90e1f5
SHA256

4040003f1c2e98555506444cc8ac2d47c529fb3b119b649d70589557b7fea428
SHA512

7c4e1cf0e982e328646069af7ec20a0d3345764f3c4a9b22c55228910cbbce77cc18d63e428252934f33fca667d1fa937a03a529ae25a99560a3ce2a86b227ad
SSDEEP

768:xnOK+3JqS9V+dMCdSsAVlNmpB7w3PBGU+w73fCFxOqLMBH3fxa1Vu6dX4aGdnbcc:xnOHoSTtCd8Nmvs3PBGAva8qLMBHMFdk

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/3020-2-0x0000000010000000-0x0000000010034000-memory.dmp	upx
behavioral1/memory/3020-1-0x0000000010000000-0x0000000010034000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\version1.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3020	rundll32.exe
3020	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 3020	1800	rundll32.exe	14
PID 1800 wrote to memory of 3020	1800	rundll32.exe	14
PID 1800 wrote to memory of 3020	1800	rundll32.exe	14
PID 1800 wrote to memory of 3020	1800	rundll32.exe	14
PID 1800 wrote to memory of 3020	1800	rundll32.exe	14
PID 1800 wrote to memory of 3020	1800	rundll32.exe	14
PID 1800 wrote to memory of 3020	1800	rundll32.exe	14

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\681829f54228f96eba60ecec070f6a13.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1800

memory/3020-2-0x0000000010000000-0x0000000010034000-memory.dmp

Filesize
208KB

Download
memory/3020-1-0x0000000010000000-0x0000000010034000-memory.dmp

Filesize
208KB

Download