37469d024209c2f4c3dd34a5c1b8289b44a98cca4dc0732ddf58af1097c98aa0

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 01:56

Target

238e363e81e40ce2993ef270b33f7620.dll
Size

104KB
MD5

238e363e81e40ce2993ef270b33f7620
SHA1

85069cf163aba79e977a96a029adbf14e5ae90e3
SHA256

37469d024209c2f4c3dd34a5c1b8289b44a98cca4dc0732ddf58af1097c98aa0
SHA512

d67f46538329d94988f825f080ef5d575053e1a91cc68e5ebb8361e2903e3088cfa1b7ae3ff7a10f1be4b01d0d302e91ff43f649d72566703580aae677087498
SSDEEP

1536:mkJvFEhpEWiQW8xs53Nkqe5gEynSaj86WxheW4BsFdH9XHAxrhV7EAKGJI:mkJNEhOW1W3u95gtfZ8he76HkrvjXy

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2428-1-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2428	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2428	2916	rundll32.exe	14
PID 2916 wrote to memory of 2428	2916	rundll32.exe	14
PID 2916 wrote to memory of 2428	2916	rundll32.exe	14
PID 2916 wrote to memory of 2428	2916	rundll32.exe	14
PID 2916 wrote to memory of 2428	2916	rundll32.exe	14
PID 2916 wrote to memory of 2428	2916	rundll32.exe	14
PID 2916 wrote to memory of 2428	2916	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\238e363e81e40ce2993ef270b33f7620.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2428

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\238e363e81e40ce2993ef270b33f7620.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2916

memory/2428-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2428-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download