795867f574b2daff79d01398f713b7ebc9de4bc06ad384b273a67a0dd3b8a293

Analysis

max time kernel
119s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 07:38

Target

40476ff90deeeddeb01c7c4171cdbaf6.dll
Size

101KB
MD5

40476ff90deeeddeb01c7c4171cdbaf6
SHA1

af120a9d4e75ac5b4e419fb5ca3d1bafcbcd4d17
SHA256

795867f574b2daff79d01398f713b7ebc9de4bc06ad384b273a67a0dd3b8a293
SHA512

cc1c000c03921abba7f085a3ddf0949fbebe9111551512c0f5efdf8794e4dcb60e43058cf6c9b1988c14b62d0d9edfe1e6d610185ae13341d4397fa1601cf864
SSDEEP

1536:AWMnB5iDHDu6sQlE1BuMdvhfNo7tuO+nGbKtmd/RNLAuWLaPkM:h8+26TlE3uMdvS8OYGbjzNbWL1M

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2916-1-0x0000000010000000-0x000000001000D000-memory.dmp	upx
behavioral1/memory/2916-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2916	2136	rundll32.exe	14
PID 2136 wrote to memory of 2916	2136	rundll32.exe	14
PID 2136 wrote to memory of 2916	2136	rundll32.exe	14
PID 2136 wrote to memory of 2916	2136	rundll32.exe	14
PID 2136 wrote to memory of 2916	2136	rundll32.exe	14
PID 2136 wrote to memory of 2916	2136	rundll32.exe	14
PID 2136 wrote to memory of 2916	2136	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40476ff90deeeddeb01c7c4171cdbaf6.dll,#1
1⤵
PID:2916

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40476ff90deeeddeb01c7c4171cdbaf6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2136

memory/2916-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2916-2-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2916-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2916-3-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download