bee48de6404ef2f0b5cbf79de793914f7f45dc01dc7a05fa13992829cf0c1933

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-02-2024 17:55

Target

ac7e871697b822f4d4d8c734407f7e55.dll
Size

32KB
MD5

ac7e871697b822f4d4d8c734407f7e55
SHA1

69badb6906ea7b2a6cef67269fdc3f7f1b0784ca
SHA256

bee48de6404ef2f0b5cbf79de793914f7f45dc01dc7a05fa13992829cf0c1933
SHA512

51fc34da9f96da4451bc2c5eb4330ae2b59deba2522af6036b9dd70eeffd921acf238f792db9241cacb3772d27778a2ff4d04f99d2abb934e3c51c4b3f54adc6
SSDEEP

768:+JN0bMXJhuJwjFLCw+vcK1ct4Q27P/+kRfkepJnYnbcuyD7UG:UNnXiJwRCtYH27P/n1bnYnouy8G

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/544-0-0x0000000010000000-0x0000000010015000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 544	1796	rundll32.exe	28
PID 1796 wrote to memory of 544	1796	rundll32.exe	28
PID 1796 wrote to memory of 544	1796	rundll32.exe	28
PID 1796 wrote to memory of 544	1796	rundll32.exe	28
PID 1796 wrote to memory of 544	1796	rundll32.exe	28
PID 1796 wrote to memory of 544	1796	rundll32.exe	28
PID 1796 wrote to memory of 544	1796	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac7e871697b822f4d4d8c734407f7e55.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac7e871697b822f4d4d8c734407f7e55.dll,#1
  2⤵
  PID:544

memory/544-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/544-1-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/544-2-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download