e577ced6435462c351153cc883c8901d3c0d29575361b8ecf11e5f28fcdf644e

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 12:18

Target

1844e7fcab1c34e34038f9a857b95a60.dll
Size

10KB
MD5

1844e7fcab1c34e34038f9a857b95a60
SHA1

547c2671676c4881e7c86e72934fe808ae0035e6
SHA256

e577ced6435462c351153cc883c8901d3c0d29575361b8ecf11e5f28fcdf644e
SHA512

0016624a112a88926a040be57730f007c3a8e9b200a30aa3983b5bda6e42e9c7afd82e92cff88c6dd42f658cc716152cc905ec200857feae3b5ff20108e62d4e
SSDEEP

192:nrBgb2AeKi5m59NER2VSgxeEqrx2D22DUDXWRcnN1NNNkswib:NbIiKZ0g/qd2D2HWRcXfNP

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2488-0-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/2488-1-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/2488-3-0x0000000000400000-0x000000000040D000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2488	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2488	2360	rundll32.exe	28
PID 2360 wrote to memory of 2488	2360	rundll32.exe	28
PID 2360 wrote to memory of 2488	2360	rundll32.exe	28
PID 2360 wrote to memory of 2488	2360	rundll32.exe	28
PID 2360 wrote to memory of 2488	2360	rundll32.exe	28
PID 2360 wrote to memory of 2488	2360	rundll32.exe	28
PID 2360 wrote to memory of 2488	2360	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1844e7fcab1c34e34038f9a857b95a60.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1844e7fcab1c34e34038f9a857b95a60.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2488

memory/2488-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2488-1-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2488-2-0x000000007796F000-0x0000000077970000-memory.dmp

Filesize
4KB

Download
memory/2488-3-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download