e32ce5024645a2a17b23fa7b90f9f2f8e880799bc09bd1c7ae37d1f4ce55926a

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 10:54

Target

18c7e8423efabae1e0673bf5451addc4.dll
Size

23KB
MD5

18c7e8423efabae1e0673bf5451addc4
SHA1

b3d42bfda0ae47f7a4c30365385948a91a74690b
SHA256

e32ce5024645a2a17b23fa7b90f9f2f8e880799bc09bd1c7ae37d1f4ce55926a
SHA512

403784f5b66b4fc0e928252b1db065230428c77d340c808ad27cabbb4e7733e86fbb962541a660810904256234fd32dca03947ce75ca05a2f19b3c4d3c7937cd
SSDEEP

384:NFmFjCx27SHnmYsCcP0jUMUk+whhdpjWPKm/dng8/FPEaDRy9ythrSnjimre:kWx25YbcP0jUMUk+whnp0WQEQ9rKr

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2224-1-0x0000000000400000-0x0000000000413000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2224	2088	rundll32.exe	28
PID 2088 wrote to memory of 2224	2088	rundll32.exe	28
PID 2088 wrote to memory of 2224	2088	rundll32.exe	28
PID 2088 wrote to memory of 2224	2088	rundll32.exe	28
PID 2088 wrote to memory of 2224	2088	rundll32.exe	28
PID 2088 wrote to memory of 2224	2088	rundll32.exe	28
PID 2088 wrote to memory of 2224	2088	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\18c7e8423efabae1e0673bf5451addc4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\18c7e8423efabae1e0673bf5451addc4.dll,#1
  2⤵
  PID:2224

memory/2224-1-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2224-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2224-2-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download