eabb567d402c51623e0563016748fdb1b8d701b6bcb0509eb65f8aa05d694162

Analysis

max time kernel
143s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 12:23

Target

Lenin_Script/dll/Band/band.dll
Size

19KB
MD5

1dfc3f7391d4a800dfaf1bdc71f3d4b5
SHA1

62029ee67031db78f81ed9a2a1bb7e8ad3301c59
SHA256

ae66e335ccce95a10ef4260f6448812c7e84e15529cbf30372fd8ff0518c50fc
SHA512

501ef6c17c36d21b6c67e124ca70cc0800ec4186620141b2ff00de704cf0406616e04410ba44eb40fc047408a7ba0dab17e6ca567a2f5e92c26e58cdb1054271
SSDEEP

384:wtg30paiX7jlbfr3P7RrRTX/dNGHnXMiBqIFt3EJGJR:wtgEj75rr3jtRvGoIFdEJsR

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral15/memory/2020-1-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral15/memory/2020-0-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral15/memory/2020-2-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3052	2020	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2020	2208	rundll32.exe	28
PID 2208 wrote to memory of 2020	2208	rundll32.exe	28
PID 2208 wrote to memory of 2020	2208	rundll32.exe	28
PID 2208 wrote to memory of 2020	2208	rundll32.exe	28
PID 2208 wrote to memory of 2020	2208	rundll32.exe	28
PID 2208 wrote to memory of 2020	2208	rundll32.exe	28
PID 2208 wrote to memory of 2020	2208	rundll32.exe	28
PID 2020 wrote to memory of 3052	2020	rundll32.exe	29
PID 2020 wrote to memory of 3052	2020	rundll32.exe	29
PID 2020 wrote to memory of 3052	2020	rundll32.exe	29
PID 2020 wrote to memory of 3052	2020	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Lenin_Script\dll\Band\band.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Lenin_Script\dll\Band\band.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 248
    3⤵
    - Program crash
    PID:3052

memory/2020-1-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2020-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2020-2-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download