b78d9c04be2593f5315e993177d71ee80647434314285ab37579c6cc8a0bcf06

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 21:59

Target

4744a0a833d5e09957b5e6069c528929.dll
Size

68KB
MD5

4744a0a833d5e09957b5e6069c528929
SHA1

e27608fa9d4b77b04d839974090de6e66f5f16ec
SHA256

b78d9c04be2593f5315e993177d71ee80647434314285ab37579c6cc8a0bcf06
SHA512

8f7223f3187704bc86e711f60f7bcd9bc5bc182a120d17321b3aed64b5d221f9924067d8de44911bee4269cd2e44798d948a4ecb50b91ba635789594066dfa2e
SSDEEP

1536:mPO6KEVbsVP0g6hSjK7olDF0uZOuGzbDzlZXs2V6b23v:cMEVbsVcX2K7oLzOtzbDzllsjq3v

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2528-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 2528	1836	rundll32.exe	28
PID 1836 wrote to memory of 2528	1836	rundll32.exe	28
PID 1836 wrote to memory of 2528	1836	rundll32.exe	28
PID 1836 wrote to memory of 2528	1836	rundll32.exe	28
PID 1836 wrote to memory of 2528	1836	rundll32.exe	28
PID 1836 wrote to memory of 2528	1836	rundll32.exe	28
PID 1836 wrote to memory of 2528	1836	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4744a0a833d5e09957b5e6069c528929.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4744a0a833d5e09957b5e6069c528929.dll,#1
  2⤵
  PID:2528

memory/2528-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2528-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download