39f24f46064581e3a85e35b97039da86a6394daf0b5509a663f85c2cbbdee7eb

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 21:28

Target

f956bf709df7861faebc404c5c19daad.dll
Size

71KB
MD5

f956bf709df7861faebc404c5c19daad
SHA1

19bb6127ac3a4093be8ec6c40e7a7b7750c6374a
SHA256

39f24f46064581e3a85e35b97039da86a6394daf0b5509a663f85c2cbbdee7eb
SHA512

d83f5e112f034a1db615bc20ed88747257a465a026b7ae514951a21539a12a23e25d4fb8139e601c5cad9a98ed760a2b855eeb25eb1fc25ad16f28485d25f650
SSDEEP

1536:Bm1NGJVGdEC0qcsj9Yili+xAS7s5RDKHiXPcfhqd:kX0V20qcsRtli+mS7sLDKHi/cg

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2744-0-0x0000000010000000-0x0000000010013000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2744	2180	rundll32.exe	27
PID 2180 wrote to memory of 2744	2180	rundll32.exe	27
PID 2180 wrote to memory of 2744	2180	rundll32.exe	27
PID 2180 wrote to memory of 2744	2180	rundll32.exe	27
PID 2180 wrote to memory of 2744	2180	rundll32.exe	27
PID 2180 wrote to memory of 2744	2180	rundll32.exe	27
PID 2180 wrote to memory of 2744	2180	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f956bf709df7861faebc404c5c19daad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f956bf709df7861faebc404c5c19daad.dll,#1
  2⤵
  PID:2744

memory/2744-0-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2744-1-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2744-2-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download