ce8a34f6e5895eee8add7478199713a2750eb788e9eaaa22392822d0aa72da11

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-03-2024 00:15

Target

bd2c09968a1c620e9f4ca8de2db5fb2b.dll
Size

77KB
MD5

bd2c09968a1c620e9f4ca8de2db5fb2b
SHA1

a11cf61fb27ac4e327acbd5bde9dacd2cc1389fc
SHA256

ce8a34f6e5895eee8add7478199713a2750eb788e9eaaa22392822d0aa72da11
SHA512

7e9b3cd249a637f06a08573e6b9b07d6aebbda6a63c949cc480e2df7aed8f90052c575ac8d4139b2173c287c8cbb635fa1baa281dabf1cadf4e31ea1958a19f5
SSDEEP

768:tqGhkGeP6Vaay9Gy06nY0d+A9o9jwRn8cArRyRKhmwZhII5nLq72mcDhX+igksjJ:tbOd06nY+60dZihv0wDhr6fcWPZ

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2228-1-0x0000000010000000-0x000000001000B000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2228	2924	rundll32.exe	28
PID 2924 wrote to memory of 2228	2924	rundll32.exe	28
PID 2924 wrote to memory of 2228	2924	rundll32.exe	28
PID 2924 wrote to memory of 2228	2924	rundll32.exe	28
PID 2924 wrote to memory of 2228	2924	rundll32.exe	28
PID 2924 wrote to memory of 2228	2924	rundll32.exe	28
PID 2924 wrote to memory of 2228	2924	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd2c09968a1c620e9f4ca8de2db5fb2b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd2c09968a1c620e9f4ca8de2db5fb2b.dll,#1
  2⤵
  PID:2228

memory/2228-0-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download
memory/2228-1-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download