25be15bcc3192819941b70a9bb626d1dc49df9da5be05acfd6dcc758b1ab6e78

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23-01-2024 19:21

Target

705bf0718d84e2d8cd7f62498ac91a20.dll
Size

132KB
MD5

705bf0718d84e2d8cd7f62498ac91a20
SHA1

6878549a93059ad0afe6d3efc89643dc8b4cf948
SHA256

25be15bcc3192819941b70a9bb626d1dc49df9da5be05acfd6dcc758b1ab6e78
SHA512

d941866b7f5194938a7ceeae420e3259dbb193c8ff34b379eb923cbdaeba6f13c1d23f9ec5f980d3ca6826ce911faa15da007ff64664cdd6e0d6e148cf4f3eb9
SSDEEP

1536:MDEFUawhF/H8fOXIP0f02vJpR7LqB2HV6nogpgYvWZvftpUDUl:j4D/cIIP0NvJT7LqZzVy3nE+

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2448-0-0x0000000010000000-0x0000000010017000-memory.dmp	upx
behavioral1/memory/2448-1-0x0000000010000000-0x0000000010017000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2448	2420	rundll32.exe	28
PID 2420 wrote to memory of 2448	2420	rundll32.exe	28
PID 2420 wrote to memory of 2448	2420	rundll32.exe	28
PID 2420 wrote to memory of 2448	2420	rundll32.exe	28
PID 2420 wrote to memory of 2448	2420	rundll32.exe	28
PID 2420 wrote to memory of 2448	2420	rundll32.exe	28
PID 2420 wrote to memory of 2448	2420	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\705bf0718d84e2d8cd7f62498ac91a20.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\705bf0718d84e2d8cd7f62498ac91a20.dll,#1
  2⤵
  PID:2448

memory/2448-0-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/2448-1-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download