a6d27957f8def7c441b276b1636a1079c2315ba4d60446845f982adf9cd47b76

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 21:18

Target

902d472e17853efe83b3929be5832d72.dll
Size

17KB
MD5

902d472e17853efe83b3929be5832d72
SHA1

ac42d79d869b6731c17aba81532fcb26a26e392f
SHA256

a6d27957f8def7c441b276b1636a1079c2315ba4d60446845f982adf9cd47b76
SHA512

883184cd8963d469ab1012754678e875c77725a7f611e19dca42ec1ed0bf0865071cf4fe305a06d8ca1196a2f26cfba14a8b135839310e206ced6fede1052f63
SSDEEP

384:Ncp8BKrvgABq2ovmKF7MSj5FmDI6aEnH+lfTiJi25fTb:N6BrIh2ouKdbjmDVaEnH+kJi2tb

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2676-0-0x0000000010000000-0x0000000010012000-memory.dmp	upx
behavioral1/memory/2676-1-0x0000000010000000-0x0000000010012000-memory.dmp	upx
behavioral1/memory/2676-2-0x0000000010000000-0x0000000010012000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2676	2856	rundll32.exe	28
PID 2856 wrote to memory of 2676	2856	rundll32.exe	28
PID 2856 wrote to memory of 2676	2856	rundll32.exe	28
PID 2856 wrote to memory of 2676	2856	rundll32.exe	28
PID 2856 wrote to memory of 2676	2856	rundll32.exe	28
PID 2856 wrote to memory of 2676	2856	rundll32.exe	28
PID 2856 wrote to memory of 2676	2856	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\902d472e17853efe83b3929be5832d72.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\902d472e17853efe83b3929be5832d72.dll,#1
  2⤵
  PID:2676

memory/2676-0-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2676-1-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2676-2-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download