a74efdf5f4c431cc4484e12b9df9e7aea447e62837e46c7b61690a1ec152405b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 02:44

Target

762d949babf8cba35afb854e95ef1e51.dll
Size

79KB
MD5

762d949babf8cba35afb854e95ef1e51
SHA1

d69d4e76cdb4068cd29d94fbb936124cd4a3bf28
SHA256

a74efdf5f4c431cc4484e12b9df9e7aea447e62837e46c7b61690a1ec152405b
SHA512

5149f5fb122052a99048fb093258d75e08449de7c5d2bda8cd99e927aa97c21a824738b41e4b0eae63a0ffae0aa07101df46e8329947e15d65355c8ef3f2cac0
SSDEEP

1536:DKMIguFe631RvrI6lpNtZ0t6mqkHcbFmH3Xo3ZsuSQi1bL8TfGA:DMd3bI6Hd0t6m3SFmH3XjuFi1fqfGA

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2248-0-0x0000000010000000-0x0000000010970000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2248	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 2248	1644	rundll32.exe	28
PID 1644 wrote to memory of 2248	1644	rundll32.exe	28
PID 1644 wrote to memory of 2248	1644	rundll32.exe	28
PID 1644 wrote to memory of 2248	1644	rundll32.exe	28
PID 1644 wrote to memory of 2248	1644	rundll32.exe	28
PID 1644 wrote to memory of 2248	1644	rundll32.exe	28
PID 1644 wrote to memory of 2248	1644	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\762d949babf8cba35afb854e95ef1e51.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\762d949babf8cba35afb854e95ef1e51.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2248

memory/2248-0-0x0000000010000000-0x0000000010970000-memory.dmp

Filesize
9.4MB

Download