bd2c50747f5a641988e21b44b8604bcc8a4607cdf76f8a6fd8296a784c2b109c

Analysis

max time kernel
118s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 15:47

Target

3a4517ad51a89ce27a72b2b6c40b6170.dll
Size

193KB
MD5

3a4517ad51a89ce27a72b2b6c40b6170
SHA1

f9fb257bcceb5f12594a0c147da1c5eb7f14461f
SHA256

bd2c50747f5a641988e21b44b8604bcc8a4607cdf76f8a6fd8296a784c2b109c
SHA512

eb45e516c7dee5f3bb83a773a15e067560a3c5167fad08730fc9972a4d51dcf9d1f77f424bea6a475081005ba99f154f82afbf843c944f886ccb476641aeb2d1
SSDEEP

3072:P72HP/8ayS2Hode2ZWRvcThykNleuszOuAcJ6Ofmu0etPR2oN92:P72HMNKykNlXsjAyvg4PR2ob2

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2132-0-0x0000000010000000-0x0000000010032000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2132	2480	rundll32.exe	28
PID 2480 wrote to memory of 2132	2480	rundll32.exe	28
PID 2480 wrote to memory of 2132	2480	rundll32.exe	28
PID 2480 wrote to memory of 2132	2480	rundll32.exe	28
PID 2480 wrote to memory of 2132	2480	rundll32.exe	28
PID 2480 wrote to memory of 2132	2480	rundll32.exe	28
PID 2480 wrote to memory of 2132	2480	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a4517ad51a89ce27a72b2b6c40b6170.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a4517ad51a89ce27a72b2b6c40b6170.dll,#1
  2⤵
  PID:2132

memory/2132-0-0x0000000010000000-0x0000000010032000-memory.dmp

Filesize
200KB

Download