21c987df90c8ee602fdcdbfa3f76d56c05b21fe6bca505fe758a1c7c076b708b

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 20:24

Target

10bab67b0b24905922577fad2045defa.dll
Size

52KB
MD5

10bab67b0b24905922577fad2045defa
SHA1

57596e1786861f2fcbcc43ec1530d80a0bfc67bf
SHA256

21c987df90c8ee602fdcdbfa3f76d56c05b21fe6bca505fe758a1c7c076b708b
SHA512

0bdf2a22fcde170efd2393644ba4a9f0eed78f19d165dc809f3c4b766e53f0de7e0bbd8cb3ad384f6a4f965755ce2c042b1109f40aa69a342ef155a725a63704
SSDEEP

768:z3OHS8KOzT/WfTaBXOquCvA53W1nO9pLHNHhfQLPIRkSlR6K+d4Sa62FDjM:yHZ6mBexCk3W1nAFHkLslRWb12F3M

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1280-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 1280	2884	rundll32.exe	28
PID 2884 wrote to memory of 1280	2884	rundll32.exe	28
PID 2884 wrote to memory of 1280	2884	rundll32.exe	28
PID 2884 wrote to memory of 1280	2884	rundll32.exe	28
PID 2884 wrote to memory of 1280	2884	rundll32.exe	28
PID 2884 wrote to memory of 1280	2884	rundll32.exe	28
PID 2884 wrote to memory of 1280	2884	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\10bab67b0b24905922577fad2045defa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\10bab67b0b24905922577fad2045defa.dll,#1
  2⤵
  PID:1280

memory/1280-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/1280-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/1280-2-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download