bc57c16dda383dc39c9e93c2c39e80916f860742a33056770c0a0c09bf45ed63

Analysis

max time kernel
118s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 00:59

Target

095257db541c326126b0643b922d4cbd.dll
Size

18KB
MD5

095257db541c326126b0643b922d4cbd
SHA1

9aae8623f1db7d2577c7973a4673717a48f2844d
SHA256

bc57c16dda383dc39c9e93c2c39e80916f860742a33056770c0a0c09bf45ed63
SHA512

1b58e1503892704d50637726609a989eb7e549ef5c60e58aeef90f0082bc2c74e55b14fcb26eca1246b181e26c12d299f785c011c05914a4814923d13cea52f9
SSDEEP

384:RHR43aToTJt6Lg6Ega1cfDpfzKugWAHLfNotjbOvG:Z2KauGga18zKDHLFGjbK

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2092-1-0x0000000010000000-0x0000000010011000-memory.dmp	upx
behavioral1/memory/2092-0-0x0000000010000000-0x0000000010011000-memory.dmp	upx
behavioral1/memory/2092-2-0x0000000010000000-0x0000000010011000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2092	2900	rundll32.exe	28
PID 2900 wrote to memory of 2092	2900	rundll32.exe	28
PID 2900 wrote to memory of 2092	2900	rundll32.exe	28
PID 2900 wrote to memory of 2092	2900	rundll32.exe	28
PID 2900 wrote to memory of 2092	2900	rundll32.exe	28
PID 2900 wrote to memory of 2092	2900	rundll32.exe	28
PID 2900 wrote to memory of 2092	2900	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\095257db541c326126b0643b922d4cbd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\095257db541c326126b0643b922d4cbd.dll,#1
  2⤵
  PID:2092

memory/2092-1-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/2092-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/2092-5-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/2092-4-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/2092-3-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/2092-2-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download