c252ad96610d51dad699a9a44fda923cfed4757a9e5af5d119777d75cc894e78

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 03:30

Target

267447766cd694696b4e82232a944a3d.dll
Size

12KB
MD5

267447766cd694696b4e82232a944a3d
SHA1

11b206de332705b47366f60e7eb26f20c15d4aa3
SHA256

c252ad96610d51dad699a9a44fda923cfed4757a9e5af5d119777d75cc894e78
SHA512

ff9d6839c5579739e72b05cc8ca5ece12c78bf97408117fdb7895b9535fdc5d96e6519e992e2c0a32723c7f22c5f91b24af2fe092a9da89d29ea5db1c1f7bc3f
SSDEEP

192:nroiGqRk3a+vNlPss9xrpntWi0kk6AfwUqgqItepoQ8Y2OuiYiHkraukv:spqRk3fvPvxrptW8UFq+L2kraT

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2900-0-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2900	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2900	2888	rundll32.exe	15
PID 2888 wrote to memory of 2900	2888	rundll32.exe	15
PID 2888 wrote to memory of 2900	2888	rundll32.exe	15
PID 2888 wrote to memory of 2900	2888	rundll32.exe	15
PID 2888 wrote to memory of 2900	2888	rundll32.exe	15
PID 2888 wrote to memory of 2900	2888	rundll32.exe	15
PID 2888 wrote to memory of 2900	2888	rundll32.exe	15

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\267447766cd694696b4e82232a944a3d.dll,#1
1⤵
- Suspicious use of SetWindowsHookEx
PID:2900

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\267447766cd694696b4e82232a944a3d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2888

memory/2900-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2900-1-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2900-2-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download