a07062cb5e0bc9f8f7250ba9f1b1e81641c96b74659af89da2da28b983a8cef4

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 20:07

Target

XMTS20090628/Tools.dll
Size

25KB
MD5

456fedb95b2fc1c1074e06f0217ba5a6
SHA1

cec2c0872771e6d8b12850d61d4eddbf6017d8bc
SHA256

f20a1b7c36001a1cc8f3b15053342ba9378bdc583ca251f162de276c5f63e8f3
SHA512

1785272321fafa61ffeed4f02473d941f36bd6fcf42f7a80e31e316ba1b8523ac49b020b6fd832380b4043cb30852bd326b0e23ed7a9a49b3fd15e4cefaa0c30
SSDEEP

384:kBIq38cQzR9Fcs++31jHQi7TynpJB5nwekOltwnt2eK78/DXwBHz9G8tKER8e9t:kBh38cQvF5pHPypBdD/yDXwnxJ/9t

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral3/memory/2852-0-0x0000000000400000-0x0000000000414000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 2852	1572	rundll32.exe	28
PID 1572 wrote to memory of 2852	1572	rundll32.exe	28
PID 1572 wrote to memory of 2852	1572	rundll32.exe	28
PID 1572 wrote to memory of 2852	1572	rundll32.exe	28
PID 1572 wrote to memory of 2852	1572	rundll32.exe	28
PID 1572 wrote to memory of 2852	1572	rundll32.exe	28
PID 1572 wrote to memory of 2852	1572	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XMTS20090628\Tools.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\XMTS20090628\Tools.dll,#1
  2⤵
  PID:2852

memory/2852-1-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2852-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2852-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download