eb058297d487235813fdf82ed37f88bbd24359b7cf9bd6b8e8ec59ccf7ddb3df

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 23:07

Target

4767ac6e046927fc98e493311c419481.dll
Size

136KB
MD5

4767ac6e046927fc98e493311c419481
SHA1

ae24407a135dda4680c8047b32bd52c77981a97b
SHA256

eb058297d487235813fdf82ed37f88bbd24359b7cf9bd6b8e8ec59ccf7ddb3df
SHA512

ee3a55c08aedf9e298de44bf15daaa67859bae0f84a22b5207f8550738d793d561054c95716d8b0f17d33337f899d936879126f70f0b42f25af9110beda68250
SSDEEP

3072:hcTexcTpnkmgm57XxoUHJA8btvQejRCe4+i5rmFk6nI6/iz4KpcUSgROcAAWy:KTe6iu7Xxo0ZQWcJ+i5rmfnI8iKmOcPd

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1992-1-0x0000000010000000-0x000000001004C000-memory.dmp	upx
behavioral1/memory/1992-0-0x0000000010000000-0x000000001004C000-memory.dmp	upx
behavioral1/memory/1992-2-0x0000000010000000-0x000000001004C000-memory.dmp	upx
behavioral1/memory/1992-3-0x0000000010000000-0x000000001004C000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1992	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 1992	2360	rundll32.exe	16
PID 2360 wrote to memory of 1992	2360	rundll32.exe	16
PID 2360 wrote to memory of 1992	2360	rundll32.exe	16
PID 2360 wrote to memory of 1992	2360	rundll32.exe	16
PID 2360 wrote to memory of 1992	2360	rundll32.exe	16
PID 2360 wrote to memory of 1992	2360	rundll32.exe	16
PID 2360 wrote to memory of 1992	2360	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4767ac6e046927fc98e493311c419481.dll,#1
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1992

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4767ac6e046927fc98e493311c419481.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2360

memory/1992-1-0x0000000010000000-0x000000001004C000-memory.dmp

Filesize
304KB

Download
memory/1992-0-0x0000000010000000-0x000000001004C000-memory.dmp

Filesize
304KB

Download
memory/1992-2-0x0000000010000000-0x000000001004C000-memory.dmp

Filesize
304KB

Download
memory/1992-3-0x0000000010000000-0x000000001004C000-memory.dmp

Filesize
304KB

Download