d3ad797c0e434efa2145dabffbbe1aa5fe3471ec388609dc2db5b427c4501581

Analysis

max time kernel
122s
max time network
160s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 04:24

Target

0503a7a8721e25a0f0246c02ff190295.dll
Size

17KB
MD5

0503a7a8721e25a0f0246c02ff190295
SHA1

96071d30b5c35758c249c424e1c10da77ef4c477
SHA256

d3ad797c0e434efa2145dabffbbe1aa5fe3471ec388609dc2db5b427c4501581
SHA512

d1e297e0d136b9afe4f238a46e7c85e7e717ee304220695192268574b76a4d3d127213859aa6775ac8d7f6177eacdf3ceb20936220b60616bee598ab88808705
SSDEEP

384:aVwJJQxytV3h7r8HAt9AqhFNeyh2/6hDgZA+/8BYgBzWx5iGZ:/QxsR7rwsmqhF8/6lgZB/8en5iGZ

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1180-0-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1180-1-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1180-2-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 1180	2736	rundll32.exe	29
PID 2736 wrote to memory of 1180	2736	rundll32.exe	29
PID 2736 wrote to memory of 1180	2736	rundll32.exe	29
PID 2736 wrote to memory of 1180	2736	rundll32.exe	29
PID 2736 wrote to memory of 1180	2736	rundll32.exe	29
PID 2736 wrote to memory of 1180	2736	rundll32.exe	29
PID 2736 wrote to memory of 1180	2736	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0503a7a8721e25a0f0246c02ff190295.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0503a7a8721e25a0f0246c02ff190295.dll,#1
  2⤵
  PID:1180

memory/1180-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1180-1-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1180-2-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download