b44327d35738a79486e10d163477f4888a9cd375d29f4a62e7881d37776a6f3b

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 10:53

Target

167de66216abe1ef4be2069cf2b60417.dll
Size

97KB
MD5

167de66216abe1ef4be2069cf2b60417
SHA1

f8141c87694ad386cee6697255b9effe90785dd3
SHA256

b44327d35738a79486e10d163477f4888a9cd375d29f4a62e7881d37776a6f3b
SHA512

089bb0abe8959803e206a69afb5c5c3e5939c27aacf355547acc65e45b64b95f7b0486f505be64db62a03a342e89058c40a7a06f17300608b91259acf887f622
SSDEEP

1536:Mi/U/oFRhX5OBNTdfdBSbE9B6umJKltIX/hST4NVV8Re6lB1PaX7JXYm7t306y:O/k5ATdB0EPsKg5+Czi1PaXFTkr

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1984-0-0x0000000010000000-0x000000001002C000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 1984	2428	rundll32.exe	14
PID 2428 wrote to memory of 1984	2428	rundll32.exe	14
PID 2428 wrote to memory of 1984	2428	rundll32.exe	14
PID 2428 wrote to memory of 1984	2428	rundll32.exe	14
PID 2428 wrote to memory of 1984	2428	rundll32.exe	14
PID 2428 wrote to memory of 1984	2428	rundll32.exe	14
PID 2428 wrote to memory of 1984	2428	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\167de66216abe1ef4be2069cf2b60417.dll,#1
1⤵
PID:1984

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\167de66216abe1ef4be2069cf2b60417.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2428

memory/1984-2-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download
memory/1984-1-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download
memory/1984-0-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download