cf2f4e6c0fb8c4594f7fb11b910fb88eb79f03180c507460a9d2eb5d3e37b97c

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 13:02

Target

9bbe466c038f2c201903dd2c0a69cb80.dll
Size

14KB
MD5

9bbe466c038f2c201903dd2c0a69cb80
SHA1

b014197dd21baf2985588f39991b9dc8980144df
SHA256

cf2f4e6c0fb8c4594f7fb11b910fb88eb79f03180c507460a9d2eb5d3e37b97c
SHA512

70c5e04867ffbee788571ed4bdbb07df088651233e2312b18a22d4deb1524976895b6fcee9bf2ae30ef3fad2606792e278f869978c4f68f7284a2997c9e1c4fa
SSDEEP

192:/+a8MFCBG2i4Gtf73cWu5u1oE5dgzUR6xCtIO2OROExfjDecAtQQvkcips:/k2Dtf73KeoEH/3KOoExf2cAtQGH

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2192-1-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral1/memory/2192-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2192	2204	rundll32.exe	28
PID 2204 wrote to memory of 2192	2204	rundll32.exe	28
PID 2204 wrote to memory of 2192	2204	rundll32.exe	28
PID 2204 wrote to memory of 2192	2204	rundll32.exe	28
PID 2204 wrote to memory of 2192	2204	rundll32.exe	28
PID 2204 wrote to memory of 2192	2204	rundll32.exe	28
PID 2204 wrote to memory of 2192	2204	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9bbe466c038f2c201903dd2c0a69cb80.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9bbe466c038f2c201903dd2c0a69cb80.dll,#1
  2⤵
  PID:2192

memory/2192-1-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2192-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download