ca752aecc85201b01e7fc540ae803c9fe591683b80688254640d9cd97a14c926

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 11:19

Target

994a71086e087cd8036208dace1f9655.dll
Size

60KB
MD5

994a71086e087cd8036208dace1f9655
SHA1

1fb04a08edf452c36921b3ab99559aaee6176697
SHA256

ca752aecc85201b01e7fc540ae803c9fe591683b80688254640d9cd97a14c926
SHA512

33fb681dd4b245ba257e30e4b9c02fd560b798bbdb1640a700b8f795de25c4aea79cbfc7906240153af4ecebbff32da1d7a6cd43cea650e70cc9e5940b49c891
SSDEEP

768:m+YlPqpYYevVxo5fH5CbLqsnUazwEAjVrnsGCPgO642preBnTgrmt9i9e/24MRoi:tDhkLVzw/B7QYD42preBTg7b

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2984-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2984	2976	rundll32.exe	28
PID 2976 wrote to memory of 2984	2976	rundll32.exe	28
PID 2976 wrote to memory of 2984	2976	rundll32.exe	28
PID 2976 wrote to memory of 2984	2976	rundll32.exe	28
PID 2976 wrote to memory of 2984	2976	rundll32.exe	28
PID 2976 wrote to memory of 2984	2976	rundll32.exe	28
PID 2976 wrote to memory of 2984	2976	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\994a71086e087cd8036208dace1f9655.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\994a71086e087cd8036208dace1f9655.dll,#1
  2⤵
  PID:2984

memory/2984-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2984-1-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download