799b562d069a940c5fca342d56bc8f48b18086f9e8f535c4ec06be33d11894f4

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 04:09

Target

0489056c3c8e54e960798f644c3330bd.dll
Size

61KB
MD5

0489056c3c8e54e960798f644c3330bd
SHA1

2a6c5de2251608ef566d1ba83a6d464d68f785ab
SHA256

799b562d069a940c5fca342d56bc8f48b18086f9e8f535c4ec06be33d11894f4
SHA512

c3078f8f29dcdc2686aadd026afbb2bd0d64af5de83daae4eb0334e8301760d6c6dec7a07e1abe7c6227000efe51dd1a77032dac24bc9084cf5870b0764ac863
SSDEEP

1536:V8O9Nn6RjrinPuQ/4jHosHk4VmVSYyqWIV1W/iNUrjNSLSuWtdq3:2Oz6VWWQKHtRmVSlf1/rrjNptM3

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/3040-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 3040	776	rundll32.exe	28
PID 776 wrote to memory of 3040	776	rundll32.exe	28
PID 776 wrote to memory of 3040	776	rundll32.exe	28
PID 776 wrote to memory of 3040	776	rundll32.exe	28
PID 776 wrote to memory of 3040	776	rundll32.exe	28
PID 776 wrote to memory of 3040	776	rundll32.exe	28
PID 776 wrote to memory of 3040	776	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0489056c3c8e54e960798f644c3330bd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0489056c3c8e54e960798f644c3330bd.dll,#1
  2⤵
  PID:3040

memory/3040-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/3040-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download