6c1da2b12d813f7455f32393e659211e1e9a2bdf5ce5aa4227cbf8117c8bd4e7

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 08:34

Target

8eb220fbf138bbd3fb39718ac06e6812.dll
Size

66KB
MD5

8eb220fbf138bbd3fb39718ac06e6812
SHA1

d85c1a0466a28828b1ac68b6dd84b949b9731e33
SHA256

6c1da2b12d813f7455f32393e659211e1e9a2bdf5ce5aa4227cbf8117c8bd4e7
SHA512

9e5c1c05ea1f5f5ecac7b196de702f1c27f3dc44b6ed24c0460493698ada58a4ad76755133c5d9be0fc81a80c23abe080675e8eebaf86fca7040ce75338d2c14
SSDEEP

1536:YqCQXmVONA/NRs85+68b811n/d+W22lSyvG4zrbiNMOzuzM/Kn5:JCQ2QOj+6Q0/d+W20HoMrgi5

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2616-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2616	2100	rundll32.exe	28
PID 2100 wrote to memory of 2616	2100	rundll32.exe	28
PID 2100 wrote to memory of 2616	2100	rundll32.exe	28
PID 2100 wrote to memory of 2616	2100	rundll32.exe	28
PID 2100 wrote to memory of 2616	2100	rundll32.exe	28
PID 2100 wrote to memory of 2616	2100	rundll32.exe	28
PID 2100 wrote to memory of 2616	2100	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8eb220fbf138bbd3fb39718ac06e6812.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8eb220fbf138bbd3fb39718ac06e6812.dll,#1
  2⤵
  PID:2616

memory/2616-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download