428a404ba6e0c010962563e46dcebec3c4ab9a322958987a4db4b05699c58782

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 10:40

Target

a391bc67361266cae920888cd5b2e584.dll
Size

98KB
MD5

a391bc67361266cae920888cd5b2e584
SHA1

73bd68e6ba013597384c0c7104263f060a4a7729
SHA256

428a404ba6e0c010962563e46dcebec3c4ab9a322958987a4db4b05699c58782
SHA512

14ac1d8059b83f0a57cfff218d51e837d3323a4ba7f6050e774b95f6d63e9363f921d7c21a670e5aab0140f1973dc9cae782e353de673c35311b70e9ae7609d3
SSDEEP

1536:kqKlQnkeUs8C9DtpLwwP4kDBeKlBFNj7PvHwCZzTOHQdn1xSZ/NZoFsT:k5g8C/xDkKtB7PvQCZuHqs/AY

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1400-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 1400	1260	rundll32.exe	28
PID 1260 wrote to memory of 1400	1260	rundll32.exe	28
PID 1260 wrote to memory of 1400	1260	rundll32.exe	28
PID 1260 wrote to memory of 1400	1260	rundll32.exe	28
PID 1260 wrote to memory of 1400	1260	rundll32.exe	28
PID 1260 wrote to memory of 1400	1260	rundll32.exe	28
PID 1260 wrote to memory of 1400	1260	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a391bc67361266cae920888cd5b2e584.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a391bc67361266cae920888cd5b2e584.dll,#1
  2⤵
  PID:1400

memory/1400-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/1400-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download