2a7da68c306314e2d1ba01f979cc5db30d715f6878a0c1157d9eccbab7c1e17b

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 20:28

Target

c1868314c9947e3185547d91f27f86cb.dll
Size

174KB
MD5

c1868314c9947e3185547d91f27f86cb
SHA1

ab1ca5a423c5761604b21d8750742a4754388cca
SHA256

2a7da68c306314e2d1ba01f979cc5db30d715f6878a0c1157d9eccbab7c1e17b
SHA512

8f403a41e402f188187d8d72b5b0819a033eaa9d10d7f851288d8352315584562c63399fff4de82c58b2e8b573cf0291ed5f9eac9b163ddd107376a4488b1171
SSDEEP

3072:IBxAEO54ToSbLhQghqp2TRaE6kiPUOIWlpwpk36AxDI:IBxAGoSbLhYp2gEHaUOwG6ARI

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2712-2-0x00000000001E0000-0x00000000001ED000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2712	2476	rundll32.exe	28
PID 2476 wrote to memory of 2712	2476	rundll32.exe	28
PID 2476 wrote to memory of 2712	2476	rundll32.exe	28
PID 2476 wrote to memory of 2712	2476	rundll32.exe	28
PID 2476 wrote to memory of 2712	2476	rundll32.exe	28
PID 2476 wrote to memory of 2712	2476	rundll32.exe	28
PID 2476 wrote to memory of 2712	2476	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1868314c9947e3185547d91f27f86cb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1868314c9947e3185547d91f27f86cb.dll,#1
  2⤵
  PID:2712

memory/2712-0-0x00000000001D0000-0x00000000001DD000-memory.dmp

Filesize
52KB

Download
memory/2712-1-0x00000000001D0000-0x00000000001DD000-memory.dmp

Filesize
52KB

Download
memory/2712-2-0x00000000001E0000-0x00000000001ED000-memory.dmp

Filesize
52KB

Download
memory/2712-5-0x00000000001D0000-0x00000000001DD000-memory.dmp

Filesize
52KB

Download
memory/2712-7-0x00000000001D0000-0x00000000001DD000-memory.dmp

Filesize
52KB

Download
memory/2712-6-0x00000000001D0000-0x00000000001DD000-memory.dmp

Filesize
52KB

Download