6e89d3675b055c9f26b4b88b53af23104b39a587a108921d06f8b5b5a8ba0db4

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 06:25

Target

bde59384f1c6f45101765f38f29604ac.dll
Size

140KB
MD5

bde59384f1c6f45101765f38f29604ac
SHA1

03d0f807363274b35fe8aa0d79c6f08fb5aada64
SHA256

6e89d3675b055c9f26b4b88b53af23104b39a587a108921d06f8b5b5a8ba0db4
SHA512

eb25c76180bb7e480a9d1817f988c009061daef0490b10735dea7e3e04488d5fa9512ad1832feedaa72b7eac9357840f4eb5c3ff003abd4345acec803d769532
SSDEEP

3072:f1+VvJLfTjdh7Z5jR2lALDnRa5cQXYYHO3HYSZeHNa9lq:9cBLbjB5t2lAXnREwEO3HdZ+J

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2956-0-0x0000000000190000-0x000000000019E000-memory.dmp	upx
behavioral1/memory/2956-7-0x0000000000190000-0x000000000019E000-memory.dmp	upx
behavioral1/memory/2956-6-0x0000000000190000-0x000000000019E000-memory.dmp	upx
behavioral1/memory/2956-8-0x0000000000190000-0x000000000019E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2956	2196	rundll32.exe	28
PID 2196 wrote to memory of 2956	2196	rundll32.exe	28
PID 2196 wrote to memory of 2956	2196	rundll32.exe	28
PID 2196 wrote to memory of 2956	2196	rundll32.exe	28
PID 2196 wrote to memory of 2956	2196	rundll32.exe	28
PID 2196 wrote to memory of 2956	2196	rundll32.exe	28
PID 2196 wrote to memory of 2956	2196	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bde59384f1c6f45101765f38f29604ac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bde59384f1c6f45101765f38f29604ac.dll,#1
  2⤵
  PID:2956

memory/2956-2-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2956-0-0x0000000000190000-0x000000000019E000-memory.dmp

Filesize
56KB

Download
memory/2956-4-0x0000000000180000-0x0000000000186000-memory.dmp

Filesize
24KB

Download
memory/2956-7-0x0000000000190000-0x000000000019E000-memory.dmp

Filesize
56KB

Download
memory/2956-6-0x0000000000190000-0x000000000019E000-memory.dmp

Filesize
56KB

Download
memory/2956-8-0x0000000000190000-0x000000000019E000-memory.dmp

Filesize
56KB

Download
memory/2956-9-0x0000000000191000-0x0000000000197000-memory.dmp

Filesize
24KB

Download