054b681f953cca64eea0afc1aca0f63735a6bb03df7786c1ec59eb24fa9ceb2c

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 01:40

Target

231b42ae39627fea2de631b3909974f3.dll
Size

166KB
MD5

231b42ae39627fea2de631b3909974f3
SHA1

01bf3d845d0141be8482c7748ffe5b7eb58292dd
SHA256

054b681f953cca64eea0afc1aca0f63735a6bb03df7786c1ec59eb24fa9ceb2c
SHA512

466a30c0a4122be12444afcb867d4b70cd796bb3b127d55ea676db2d57293b9e4437567d42d43060ef2a049725c702b0eb0d0ebbaf054ac698aa68c4e95d52fa
SSDEEP

3072:3+opLz0mNlXJ35SxUFlzcbTb1aiTdMJfLGZQ84sypytlJtiAVz6WlT3AJo:3bpz0mnJ38xgzAU7JyZQ84YDttVzdlc

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2456-1-0x0000000010000000-0x000000001007F000-memory.dmp	upx
behavioral1/memory/2456-0-0x0000000010000000-0x000000001007F000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2456	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2456	2184	rundll32.exe	15
PID 2184 wrote to memory of 2456	2184	rundll32.exe	15
PID 2184 wrote to memory of 2456	2184	rundll32.exe	15
PID 2184 wrote to memory of 2456	2184	rundll32.exe	15
PID 2184 wrote to memory of 2456	2184	rundll32.exe	15
PID 2184 wrote to memory of 2456	2184	rundll32.exe	15
PID 2184 wrote to memory of 2456	2184	rundll32.exe	15

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\231b42ae39627fea2de631b3909974f3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\231b42ae39627fea2de631b3909974f3.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2456

memory/2456-1-0x0000000010000000-0x000000001007F000-memory.dmp

Filesize
508KB

Download
memory/2456-0-0x0000000010000000-0x000000001007F000-memory.dmp

Filesize
508KB

Download