75e6378fb7505de58ac7011070b84481c80abf69bdf7be94f2b2e68a6086d210

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10-01-2024 23:41

Target

51f184ac3f6d5457e285ebce03d375b9.dll
Size

12KB
MD5

51f184ac3f6d5457e285ebce03d375b9
SHA1

0b80425583ddba404818c3943c889cacb1be26ef
SHA256

75e6378fb7505de58ac7011070b84481c80abf69bdf7be94f2b2e68a6086d210
SHA512

54f0c9bde181955f78d12207321fee7672c01668b4f548c3ba9044fdb3320b108d7ec0fcf0d22ad6c11496aa7bed47a78bdad20b08a1e1ec7de2dd3d6e970435
SSDEEP

192:kvQqQLVXh8gaFLKlcMsDBe4dGTLlPG4pdAaTXdjjBxXp4eh6JhU89zvE4:kvaVmzFLNDDBe9TLlb7Xdjjrns+8tv

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2772-0-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/2772-1-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2772	2304	rundll32.exe	28
PID 2304 wrote to memory of 2772	2304	rundll32.exe	28
PID 2304 wrote to memory of 2772	2304	rundll32.exe	28
PID 2304 wrote to memory of 2772	2304	rundll32.exe	28
PID 2304 wrote to memory of 2772	2304	rundll32.exe	28
PID 2304 wrote to memory of 2772	2304	rundll32.exe	28
PID 2304 wrote to memory of 2772	2304	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\51f184ac3f6d5457e285ebce03d375b9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\51f184ac3f6d5457e285ebce03d375b9.dll,#1
  2⤵
  PID:2772

memory/2772-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2772-1-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download