cb2b5d2458890342b322ee6d1dc9005ff2d0dc5993770b6803429e201baf3ac5

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 15:55

Target

b51614373059edbae403481ccf25b5fb.dll
Size

130KB
MD5

b51614373059edbae403481ccf25b5fb
SHA1

ee09eeba7be380e2c2864cd8cfed9f1f323c6151
SHA256

cb2b5d2458890342b322ee6d1dc9005ff2d0dc5993770b6803429e201baf3ac5
SHA512

a266b6a73366edd11ef28fb6fc9f8815a8cd4d69e79dc2f0fd0d29190300cb22a6a45176316ccec213aece046ed9dc73e5a94f118e8ec3fc69af2369e798582f
SSDEEP

1536:PpEFUaLBF/H8MeVpBvlqAnJKK+e4n2nnxFTTDKZYielt12dHQT:izj/czVpBvcAncK+e4mxFTTDLt1WHq

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2912-0-0x0000000010000000-0x0000000010017000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2912	2860	rundll32.exe	28
PID 2860 wrote to memory of 2912	2860	rundll32.exe	28
PID 2860 wrote to memory of 2912	2860	rundll32.exe	28
PID 2860 wrote to memory of 2912	2860	rundll32.exe	28
PID 2860 wrote to memory of 2912	2860	rundll32.exe	28
PID 2860 wrote to memory of 2912	2860	rundll32.exe	28
PID 2860 wrote to memory of 2912	2860	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b51614373059edbae403481ccf25b5fb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b51614373059edbae403481ccf25b5fb.dll,#1
  2⤵
  PID:2912

memory/2912-0-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/2912-1-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download