e5fef32be6fc92697260d56d3844f90bcdda0104c4dfbf8988d5aadd8fb60eb0

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 10:28

Target

super-simple-wall-v4.8/Super Simple Wall v4.8/SSW4.8.dll
Size

5KB
MD5

e04448a17b7550427a2f88062a81bc92
SHA1

c72729d9e4e91611d6c3bd15edeb501b9ad53728
SHA256

d181f539fd691a459e73884d91ff273ad4d6b2b88b50fd4da593a2bfd70f94f4
SHA512

1e23b15c14f913ee80b57dbd39807184365a937bccecbd378f9d530f2993d74e46772bb03bb9371f63e9e5f2b80656fe203a15ec1823a008b9b769499e6fd3b6
SSDEEP

96:liNFobSQqyPVY5AaXcAsI5xx552tRA/c1vvw:l6iLVEApAXxTCt1v

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2252-0-0x0000000010000000-0x0000000010009000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2252	2448	rundll32.exe	16
PID 2448 wrote to memory of 2252	2448	rundll32.exe	16
PID 2448 wrote to memory of 2252	2448	rundll32.exe	16
PID 2448 wrote to memory of 2252	2448	rundll32.exe	16
PID 2448 wrote to memory of 2252	2448	rundll32.exe	16
PID 2448 wrote to memory of 2252	2448	rundll32.exe	16
PID 2448 wrote to memory of 2252	2448	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\super-simple-wall-v4.8\Super Simple Wall v4.8\SSW4.8.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\super-simple-wall-v4.8\Super Simple Wall v4.8\SSW4.8.dll",#1
  2⤵
  PID:2252

memory/2252-0-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download
memory/2252-1-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download