6f51460843031beffe8e712e1024391e52e2aa872c809f48a104b91fba836de4

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 08:57

Target

64fedc5e818897338cc16ed8425eac5a.dll
Size

52KB
MD5

64fedc5e818897338cc16ed8425eac5a
SHA1

aa833e9a95d43a1f66b4f8ff2e0a9806ff001d4b
SHA256

6f51460843031beffe8e712e1024391e52e2aa872c809f48a104b91fba836de4
SHA512

d86e6ade677e54342e14e5a6e31bc8272244a62831d872271a5ad3e4f74fa6ad1edcd00e5bde0eeb0334b56dee847b96049f78b072709c605aa3a3b06a11ef96
SSDEEP

768:GbvLDaaMact8T1DNvNyUr07tppOz7XBozujvSRsL7caMd2ZwDIyH8DEPjQ6WBQ4+:evBJ907bpOHX3aRsLJMywDIyHSIQ6yQX

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1736-0-0x0000000010000000-0x000000001000C000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 1736	1840	rundll32.exe	16
PID 1840 wrote to memory of 1736	1840	rundll32.exe	16
PID 1840 wrote to memory of 1736	1840	rundll32.exe	16
PID 1840 wrote to memory of 1736	1840	rundll32.exe	16
PID 1840 wrote to memory of 1736	1840	rundll32.exe	16
PID 1840 wrote to memory of 1736	1840	rundll32.exe	16
PID 1840 wrote to memory of 1736	1840	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\64fedc5e818897338cc16ed8425eac5a.dll,#1
1⤵
PID:1736

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\64fedc5e818897338cc16ed8425eac5a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1840

memory/1736-0-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download