512b66387a468d0b4996d8b335fe81fba8f12eff1352f5f11707d1ca593105d5

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 14:07

Target

97553d0a558d5f01fcb4420e4c2b1079.dll
Size

61KB
MD5

97553d0a558d5f01fcb4420e4c2b1079
SHA1

07228da4156c6efeb2f234f6183996a8b6a83428
SHA256

512b66387a468d0b4996d8b335fe81fba8f12eff1352f5f11707d1ca593105d5
SHA512

01a7a0d285bb839e8e4d3831acce51d09512cda4e78ee638905dbe9b6e9ce122893c6dc8034e1c1eb6207226d3376c5f700c9bc629d384ca18a97cbad7fe0acb
SSDEEP

1536:TTHe9FMUda1ATLkChbU5tnelb9Mj/inSlJMdpdlqSdY:nHuK1Q48YPnelbSLyI8bO

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1948-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 1948	1452	rundll32.exe	28
PID 1452 wrote to memory of 1948	1452	rundll32.exe	28
PID 1452 wrote to memory of 1948	1452	rundll32.exe	28
PID 1452 wrote to memory of 1948	1452	rundll32.exe	28
PID 1452 wrote to memory of 1948	1452	rundll32.exe	28
PID 1452 wrote to memory of 1948	1452	rundll32.exe	28
PID 1452 wrote to memory of 1948	1452	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\97553d0a558d5f01fcb4420e4c2b1079.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\97553d0a558d5f01fcb4420e4c2b1079.dll,#1
  2⤵
  PID:1948

memory/1948-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1948-1-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1948-2-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download