0fadcd4d606164344ebf55a20341947700dfc19120214f8eff1c80a8707e521c

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 10:53

Target

7cee3b68c2cd8b0a3eeacbdd3855b4fd.dll
Size

67KB
MD5

7cee3b68c2cd8b0a3eeacbdd3855b4fd
SHA1

1c013a31c3be3a641da58dbd974a58826c7d3286
SHA256

0fadcd4d606164344ebf55a20341947700dfc19120214f8eff1c80a8707e521c
SHA512

843c2194791a45f6986c2d97a0e1f9f469d6cf868c2a717ea59155cc86da65593420d98424ca38dd115b7dddd0ff348ee6fba75a48c7a2112936dfa4aadebff8
SSDEEP

1536:1zExMwCGQ2jJ95JO6DDbKYTjq2Ty37+SXvc8iDDDnzH:1I+wCGvBQ6DDVjH6+evcNDDDnj

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2188-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 2188	1280	rundll32.exe	28
PID 1280 wrote to memory of 2188	1280	rundll32.exe	28
PID 1280 wrote to memory of 2188	1280	rundll32.exe	28
PID 1280 wrote to memory of 2188	1280	rundll32.exe	28
PID 1280 wrote to memory of 2188	1280	rundll32.exe	28
PID 1280 wrote to memory of 2188	1280	rundll32.exe	28
PID 1280 wrote to memory of 2188	1280	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7cee3b68c2cd8b0a3eeacbdd3855b4fd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7cee3b68c2cd8b0a3eeacbdd3855b4fd.dll,#1
  2⤵
  PID:2188

memory/2188-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download