58ab7a0e6c1fb9e1c95feea697964d9379460fe96685e831afece0eb1628ef98

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11-01-2024 02:38

Target

524f34635960ba1c30c5921adeef2955.dll
Size

79KB
MD5

524f34635960ba1c30c5921adeef2955
SHA1

74566f569c24aae7554302abd9b5049b28a12a6a
SHA256

58ab7a0e6c1fb9e1c95feea697964d9379460fe96685e831afece0eb1628ef98
SHA512

0663c5be52926af2b4790ebb2ac38e6812b154c8084e73de641dd9a75750808a65122413f6e8d6a7abed0c0309f9f5f3695ba05ec855f9e848ba7ae84fb9f4e7
SSDEEP

1536:UoBp6FSoU5y1BPMr0o5uJNMxc/tsmX+2CwVSBROpZR1zHhWT2sgv5vpXAalxrZJ5:rBySoUQ1Bkr0o5uJN+Qs1B6tHhq2sgvP

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1968-2-0x0000000000270000-0x00000000002AE000-memory.dmp	upx
behavioral1/memory/1968-1-0x0000000000270000-0x00000000002AE000-memory.dmp	upx
behavioral1/memory/1968-0-0x0000000000270000-0x00000000002AE000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1968	1656	rundll32.exe	14
PID 1656 wrote to memory of 1968	1656	rundll32.exe	14
PID 1656 wrote to memory of 1968	1656	rundll32.exe	14
PID 1656 wrote to memory of 1968	1656	rundll32.exe	14
PID 1656 wrote to memory of 1968	1656	rundll32.exe	14
PID 1656 wrote to memory of 1968	1656	rundll32.exe	14
PID 1656 wrote to memory of 1968	1656	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\524f34635960ba1c30c5921adeef2955.dll,#1
1⤵
PID:1968

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\524f34635960ba1c30c5921adeef2955.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1656

memory/1968-2-0x0000000000270000-0x00000000002AE000-memory.dmp

Filesize
248KB

Download
memory/1968-1-0x0000000000270000-0x00000000002AE000-memory.dmp

Filesize
248KB

Download
memory/1968-0-0x0000000000270000-0x00000000002AE000-memory.dmp

Filesize
248KB

Download
memory/1968-3-0x0000000000270000-0x00000000002AE000-memory.dmp

Filesize
248KB

Download