77ec2cb1ed9f30ea478998e3150290168fd229f8de717ecb526b1af06ec3fb86

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 18:21

Target

004daac951d13e67c59262c25db985e9.dll
Size

198KB
MD5

004daac951d13e67c59262c25db985e9
SHA1

0a82dabe028ef0565a20c2693784ad53acff389a
SHA256

77ec2cb1ed9f30ea478998e3150290168fd229f8de717ecb526b1af06ec3fb86
SHA512

8e889e70306cfe69da3d7fd52286423d8688f9a6c38421c5aa70d6ea1b1582221869a0e8b7a3f2a64b1c34afebfbe51d12426e2bed42e938db79d6416d4f6435
SSDEEP

3072:5Q10/5j01aXteQzWXcvYpMNPmOjmUOImf6OsWunItPR2oNwBZt:5Q1rpMNPvjeI6vpPR2o8Zt

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1996-0-0x0000000010000000-0x0000000010032000-memory.dmp	upx
behavioral1/memory/1996-1-0x0000000010000000-0x0000000010032000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1996	1708	rundll32.exe	23
PID 1708 wrote to memory of 1996	1708	rundll32.exe	23
PID 1708 wrote to memory of 1996	1708	rundll32.exe	23
PID 1708 wrote to memory of 1996	1708	rundll32.exe	23
PID 1708 wrote to memory of 1996	1708	rundll32.exe	23
PID 1708 wrote to memory of 1996	1708	rundll32.exe	23
PID 1708 wrote to memory of 1996	1708	rundll32.exe	23

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\004daac951d13e67c59262c25db985e9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\004daac951d13e67c59262c25db985e9.dll,#1
  2⤵
  PID:1996

memory/1996-0-0x0000000010000000-0x0000000010032000-memory.dmp

Filesize
200KB

Download
memory/1996-1-0x0000000010000000-0x0000000010032000-memory.dmp

Filesize
200KB

Download