eed96f3c8a914a822b72ef1a2c8cfbe27c36a84d5ce884534cc2378e60eb8b43

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 02:13

Target

761dca563c17b6150a69faf8bc4c813f.dll
Size

82KB
MD5

761dca563c17b6150a69faf8bc4c813f
SHA1

28ceceac7d1a66e552451bb72c00d02e7f72d1c7
SHA256

eed96f3c8a914a822b72ef1a2c8cfbe27c36a84d5ce884534cc2378e60eb8b43
SHA512

9428add293144ea3b7a9c1794739a75074d4eb54f372a026e0a45c00c0cd1cff9bcacb7ece59cc8e18ef5b9a2fce0046a093c30061552726bd333b00e5abd034
SSDEEP

1536:NKLIZ8vX3pwCPqI7l2+Zg01KRtGMbKUcXbh5wAlfpmM:EL9vX3pvPqI7l2+ZgftGQXcrhlF

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1256-0-0x0000000010000000-0x000000001000B000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 1256	2476	rundll32.exe	28
PID 2476 wrote to memory of 1256	2476	rundll32.exe	28
PID 2476 wrote to memory of 1256	2476	rundll32.exe	28
PID 2476 wrote to memory of 1256	2476	rundll32.exe	28
PID 2476 wrote to memory of 1256	2476	rundll32.exe	28
PID 2476 wrote to memory of 1256	2476	rundll32.exe	28
PID 2476 wrote to memory of 1256	2476	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\761dca563c17b6150a69faf8bc4c813f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\761dca563c17b6150a69faf8bc4c813f.dll,#1
  2⤵
  PID:1256

memory/1256-0-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download
memory/1256-1-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download
memory/1256-2-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download