a2bc5372658351f1f8442a9820c2f29a3cbaa1e19df6adc8ad6861932266ffb7

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 03:06

Target

foredu.com demo software/xSpeed.net/hardsp.dll
Size

17KB
MD5

c126b71fa9426570103a5bedb656ddad
SHA1

856ec39f9403e074d9cd220dfc8dde8742331553
SHA256

89894a149926c28a567ad56450f37698ff024fbc3e5dbc3e636b5929559c1c97
SHA512

23e213291298b35f26204e456cabb569a75c25928ecb69b645c4cf0fe6a74836c9a8a9edfb3334554e8686b42e616ca669b6a0c3c4bb36109402c4aaf5045403
SSDEEP

384:6uns2Xt8nL5SIwtxn/odt0iGCZ/2FBlAmhBDQUasXnh:6uns2XatcoHbZ/2FBlAkJisX

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral3/memory/2316-0-0x0000000010000000-0x0000000010011000-memory.dmp	upx
behavioral3/memory/2316-1-0x0000000010000000-0x0000000010011000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\winio.sys	rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
480	Process not Found

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 2316	1540	rundll32.exe	28
PID 1540 wrote to memory of 2316	1540	rundll32.exe	28
PID 1540 wrote to memory of 2316	1540	rundll32.exe	28
PID 1540 wrote to memory of 2316	1540	rundll32.exe	28
PID 1540 wrote to memory of 2316	1540	rundll32.exe	28
PID 1540 wrote to memory of 2316	1540	rundll32.exe	28
PID 1540 wrote to memory of 2316	1540	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\foredu.com demo software\xSpeed.net\hardsp.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\foredu.com demo software\xSpeed.net\hardsp.dll",#1
  2⤵
  - Drops file in System32 directory
  PID:2316

memory/2316-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/2316-1-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download