d2318c86a5b0311596db8142773d0383b3e3897f74499019b20564f51bcb0875

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 17:07

Target

everest_cpuid.dll
Size

1.1MB
MD5

a4f84fe939a0528887bc38ba8fa6bf8f
SHA1

06f4835008dab4b1373ff101ae7972f076984064
SHA256

f23614c59d2131b223dd4d0e101be8222b71529910aecc07925c363da9ab2f8b
SHA512

44b1358f8f9b932d7c1ea39c7a1f1abc83dff17c1d1aa786091a885f2a5f6538af96f2ef16adfe6e446750d43aeb76c81e433a831e0a5291bba610a53666e689
SSDEEP

24576:iS+G6AP/9Qy8jfNThmatez3lQwImr8qj+xWia3SMXghCIIDZC3wDiML8bB9t2xCL:iS+KP/Oy8jf1teztn+43ZgwIIwgDitBb

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral17/memory/1372-0-0x00000000020B0000-0x0000000002238000-memory.dmp	upx
behavioral17/memory/1372-1-0x00000000020B0000-0x0000000002238000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 1372	2404	rundll32.exe	28
PID 2404 wrote to memory of 1372	2404	rundll32.exe	28
PID 2404 wrote to memory of 1372	2404	rundll32.exe	28
PID 2404 wrote to memory of 1372	2404	rundll32.exe	28
PID 2404 wrote to memory of 1372	2404	rundll32.exe	28
PID 2404 wrote to memory of 1372	2404	rundll32.exe	28
PID 2404 wrote to memory of 1372	2404	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\everest_cpuid.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\everest_cpuid.dll,#1
  2⤵
  PID:1372

memory/1372-0-0x00000000020B0000-0x0000000002238000-memory.dmp

Filesize
1.5MB

Download
memory/1372-1-0x00000000020B0000-0x0000000002238000-memory.dmp

Filesize
1.5MB

Download