424fa341c43103e360081ec33837f4a31b0d1f3d7b54721840df1baf20b35df0

Analysis

max time kernel
240s
max time network
272s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:54

Target

255033b3427515bdba4c42080c12232d.dll
Size

74KB
MD5

255033b3427515bdba4c42080c12232d
SHA1

735ddcce11d3aa219989063c6397415f35110b56
SHA256

424fa341c43103e360081ec33837f4a31b0d1f3d7b54721840df1baf20b35df0
SHA512

7a093ebada5fc56945c832825f9afe44438ff18e7a2adfc191cff248ddb682585e1103d87523a2aca848ee1d293b52771e1220524315f4f753cd71f8d70b757d
SSDEEP

1536:jV9l/C0KG8NDuifGwCZFBMrF2AdrcVnqf1pKiODx:Bq0K79uifGT1MR2Adrynqf1e

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2944-0-0x0000000010000000-0x000000001000C000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2944	2984	rundll32.exe	27
PID 2984 wrote to memory of 2944	2984	rundll32.exe	27
PID 2984 wrote to memory of 2944	2984	rundll32.exe	27
PID 2984 wrote to memory of 2944	2984	rundll32.exe	27
PID 2984 wrote to memory of 2944	2984	rundll32.exe	27
PID 2984 wrote to memory of 2944	2984	rundll32.exe	27
PID 2984 wrote to memory of 2944	2984	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\255033b3427515bdba4c42080c12232d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\255033b3427515bdba4c42080c12232d.dll,#1
  2⤵
  PID:2944

memory/2944-0-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/2944-1-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download