9bdf01680eba948bb7280e617ec5fba62cb40aa970559feed55b044542afe820

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27-01-2024 14:50

Target

7a889ac7db1fa7738959746f3261e971.dll
Size

107KB
MD5

7a889ac7db1fa7738959746f3261e971
SHA1

84a9eff20533e0b1b0849969102bbd0eaf7f1036
SHA256

9bdf01680eba948bb7280e617ec5fba62cb40aa970559feed55b044542afe820
SHA512

6324e711bfe0dc4ea302b074182f05460db841501ae558bf4773426b71ea5bd753361bdb3a3b2a69d5de8c752fbc575ccb741314a1ef1a3c4094889a0f6555f2
SSDEEP

1536:kqKlQnkeUs8C9DtpLwTa68YO+c0DEsQZE7rUKs3NvEu/t/a0Fq98rHYQGrUJJ2bo:k5g8C/E8h3zmNsdBt/bM8EQG4JAbo

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2948-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2948	2936	rundll32.exe	7
PID 2936 wrote to memory of 2948	2936	rundll32.exe	7
PID 2936 wrote to memory of 2948	2936	rundll32.exe	7
PID 2936 wrote to memory of 2948	2936	rundll32.exe	7
PID 2936 wrote to memory of 2948	2936	rundll32.exe	7
PID 2936 wrote to memory of 2948	2936	rundll32.exe	7
PID 2936 wrote to memory of 2948	2936	rundll32.exe	7

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a889ac7db1fa7738959746f3261e971.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a889ac7db1fa7738959746f3261e971.dll,#1
  2⤵
  PID:2948

memory/2948-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download