3ccaebeaa50759ea65d8c5f5eb174dbf801d72675b204a95bbc7643c0bb948e1

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 10:40

Target

68157ac1d0424e833dd993b16a927ca8.dll
Size

66KB
MD5

68157ac1d0424e833dd993b16a927ca8
SHA1

03f7610e5a4d57d9d97e8b748ed22530dbdd32aa
SHA256

3ccaebeaa50759ea65d8c5f5eb174dbf801d72675b204a95bbc7643c0bb948e1
SHA512

4264c60f8c8fbc3afe95a8681da4334b56e65bb460fd6d94b8e155f54b611ed3c3ae7572953f059a3f09f955148ea89b4f48c9d8f69cc086c4ad37fbd83119e6
SSDEEP

1536:1zExMwCGQ2jSTenyfwdoocv61K1I+F8oon30RgEvFzbEPXZ/KFMMZ:1I+wCGvmo8wdoPv6c1I+lokRgMzCXZ/G

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2316-1-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2316	2264	rundll32.exe	16
PID 2264 wrote to memory of 2316	2264	rundll32.exe	16
PID 2264 wrote to memory of 2316	2264	rundll32.exe	16
PID 2264 wrote to memory of 2316	2264	rundll32.exe	16
PID 2264 wrote to memory of 2316	2264	rundll32.exe	16
PID 2264 wrote to memory of 2316	2264	rundll32.exe	16
PID 2264 wrote to memory of 2316	2264	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\68157ac1d0424e833dd993b16a927ca8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\68157ac1d0424e833dd993b16a927ca8.dll,#1
  2⤵
  PID:2316

memory/2316-1-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2316-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download