c4e57cf797ba45c30f8a6121eec8e0c5331d1a077fb19e1f629969254c60fba1

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 04:15

Target

0e1a764f9f6384f51d3fb76c96f350aa.dll
Size

19KB
MD5

0e1a764f9f6384f51d3fb76c96f350aa
SHA1

fc164943d730cc9dea98b84b58f2ea1da588c578
SHA256

c4e57cf797ba45c30f8a6121eec8e0c5331d1a077fb19e1f629969254c60fba1
SHA512

8e49f7a307039c80bfcb2a19d9f139e4de1f775f0251db838a8ba5e6e911a8207cacc0634c0a760d66fb4309a3da263f32cc76588213e038a38bc5042671e02b
SSDEEP

384:UPK35DE3puiIXPiNItvVMuAzNswH1QrxnPpdMan6+xtTwCFTYROXPif:X5QZuvXPi1uKGg1Q94an6Pe6f

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/3036-0-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ACADABAF-1000-0010-8000-10AA006D2EA4}\InProcServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ACADABAF-1000-0010-8000-10AA006D2EA4}\InProcServer32\ = "C:\\Windows\\system32\\system.dat"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ACADABAF-1000-0010-8000-10AA006D2EA4}	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 3036	1880	rundll32.exe	28
PID 1880 wrote to memory of 3036	1880	rundll32.exe	28
PID 1880 wrote to memory of 3036	1880	rundll32.exe	28
PID 1880 wrote to memory of 3036	1880	rundll32.exe	28
PID 1880 wrote to memory of 3036	1880	rundll32.exe	28
PID 1880 wrote to memory of 3036	1880	rundll32.exe	28
PID 1880 wrote to memory of 3036	1880	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e1a764f9f6384f51d3fb76c96f350aa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e1a764f9f6384f51d3fb76c96f350aa.dll,#1
  2⤵
  - Modifies registry class
  PID:3036

memory/3036-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download