863f6255cf7fcf235c8eedacbbc7b4746853e08aa79f2a0b126925ede94e1a88

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 18:28

Target

0bdd59b3fdad89b2187d5cda30c62e01.dll
Size

12KB
MD5

0bdd59b3fdad89b2187d5cda30c62e01
SHA1

5347e4df50356b48eaee0212a3ca7dcc2102e3d6
SHA256

863f6255cf7fcf235c8eedacbbc7b4746853e08aa79f2a0b126925ede94e1a88
SHA512

3ebcb9a048e3680668dd4f81d7808623111ef78dcf89316ab0904c620004ee6ffdc2eeca724ab46eae4c34bf52595783132b2ed685710e4c43579946f5f3bc26
SSDEEP

192:yvQqQLVXh8gaFLKlcMsDBe4dGTLlPG4pdAaTXdjjBxXp4eh6JhU89zvE4:yvaVmzFLNDDBe9TLlb7Xdjjrns+8tv

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2760-0-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2760	2848	rundll32.exe	28
PID 2848 wrote to memory of 2760	2848	rundll32.exe	28
PID 2848 wrote to memory of 2760	2848	rundll32.exe	28
PID 2848 wrote to memory of 2760	2848	rundll32.exe	28
PID 2848 wrote to memory of 2760	2848	rundll32.exe	28
PID 2848 wrote to memory of 2760	2848	rundll32.exe	28
PID 2848 wrote to memory of 2760	2848	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0bdd59b3fdad89b2187d5cda30c62e01.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0bdd59b3fdad89b2187d5cda30c62e01.dll,#1
  2⤵
  PID:2760

memory/2760-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download