f01d802f545361fb89e9075065bb11d8ec0f4ebd667a7cf2442ce47f7cefaf55

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 11:30

Target

1ae8526a14fe5ac638440aac8e3fdedb.dll
Size

63KB
MD5

1ae8526a14fe5ac638440aac8e3fdedb
SHA1

94419701f3b123e09ec6c8577ffe8c36e7406335
SHA256

f01d802f545361fb89e9075065bb11d8ec0f4ebd667a7cf2442ce47f7cefaf55
SHA512

4c5186ff6d9b6b82d6efb74ca696595335379f55dcc88b4105d61ba9435a9c326c9dc168bf2b76988d67bafd6b6778a1edaa93827f2868a14eef810799e5df67
SSDEEP

768:GWCAnFdvBNmnFfKS+3Bnes1T3X3oIqCHcXWjKKI8moY:GWCqPNmnZKT8s53oIJNKKI81Y

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2932-1-0x0000000010000000-0x0000000010011000-memory.dmp	upx
behavioral1/memory/2932-0-0x0000000010000000-0x0000000010011000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2932	2928	rundll32.exe	14
PID 2928 wrote to memory of 2932	2928	rundll32.exe	14
PID 2928 wrote to memory of 2932	2928	rundll32.exe	14
PID 2928 wrote to memory of 2932	2928	rundll32.exe	14
PID 2928 wrote to memory of 2932	2928	rundll32.exe	14
PID 2928 wrote to memory of 2932	2928	rundll32.exe	14
PID 2928 wrote to memory of 2932	2928	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ae8526a14fe5ac638440aac8e3fdedb.dll,#1
1⤵
PID:2932

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ae8526a14fe5ac638440aac8e3fdedb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2928

memory/2932-1-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/2932-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download