d2318c86a5b0311596db8142773d0383b3e3897f74499019b20564f51bcb0875

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 17:07

Target

everest_icons.dll
Size

130KB
MD5

b0efd7bf0fbf059a6c09868e9ac46d39
SHA1

11172a51d72e3408cda0500953bcdeebedacdbed
SHA256

4e3b033f8e5775821fc16b2972692a8b0d137806410b8de41b20ac02f23d4735
SHA512

7a6a70206335592a192a66d6a19977a662d218404da40833fb6f4cae7c6c3ccae3b6b38c2ebe33c76eefb8a8de08f7be5f145caa75de6aff05b39d9dfc226a3b
SSDEEP

3072:F77ACNbdmXt8A0HgCVwqnteH3zXHAxVeOqgukdUE0kUE0k0CUE0kUE0Uk0U00UUV:F//d8qgweH3s0Oqky

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral19/memory/2528-0-0x0000000000400000-0x000000000046F000-memory.dmp	upx
behavioral19/memory/2528-1-0x0000000000400000-0x000000000046F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2528	2476	rundll32.exe	28
PID 2476 wrote to memory of 2528	2476	rundll32.exe	28
PID 2476 wrote to memory of 2528	2476	rundll32.exe	28
PID 2476 wrote to memory of 2528	2476	rundll32.exe	28
PID 2476 wrote to memory of 2528	2476	rundll32.exe	28
PID 2476 wrote to memory of 2528	2476	rundll32.exe	28
PID 2476 wrote to memory of 2528	2476	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\everest_icons.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\everest_icons.dll,#1
  2⤵
  PID:2528

memory/2528-0-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2528-1-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download