64e4b417c49f279ef443825a91ee02be45ab8e6f7df379eceb2be98cb3c3366e

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 05:29

Target

965dab9f340b386ea35e92819d5b047e.dll
Size

47KB
MD5

965dab9f340b386ea35e92819d5b047e
SHA1

f30752c9afa07db56e3af064d19f801066170ed6
SHA256

64e4b417c49f279ef443825a91ee02be45ab8e6f7df379eceb2be98cb3c3366e
SHA512

6435ec36ba01204358189fa4d2f2f0b7bb8c17f522f4adb4611f7304285d4b7978b3c98c5ed150663720a6b1ae90d0212d28f49c6ccdd2ed01f442c0856ef47b
SSDEEP

768:GbvLDaaMact8T99EUvdIiGZUIsR/y3vTDKdNX5lx/6lB7TS5qHCZCZP7cx6:evx9EamZUHR/yLSroz7TFh

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2380-0-0x0000000010000000-0x000000001000C000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2380	2360	rundll32.exe	18
PID 2360 wrote to memory of 2380	2360	rundll32.exe	18
PID 2360 wrote to memory of 2380	2360	rundll32.exe	18
PID 2360 wrote to memory of 2380	2360	rundll32.exe	18
PID 2360 wrote to memory of 2380	2360	rundll32.exe	18
PID 2360 wrote to memory of 2380	2360	rundll32.exe	18
PID 2360 wrote to memory of 2380	2360	rundll32.exe	18

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\965dab9f340b386ea35e92819d5b047e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\965dab9f340b386ea35e92819d5b047e.dll,#1
  2⤵
  PID:2380

memory/2380-0-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download