45f7ff226b38766475fcc23fc9d96061c05dafe8834ebdd6d8493d17bac2bdcd

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 09:45

Target

c58e6a2c7a6e569cda51aad2efd64511.dll
Size

17KB
MD5

c58e6a2c7a6e569cda51aad2efd64511
SHA1

e0ec7ef4f29591838f507190b724c3a09bdc30f7
SHA256

45f7ff226b38766475fcc23fc9d96061c05dafe8834ebdd6d8493d17bac2bdcd
SHA512

022192f605b8f83991eb18d0b5f845036cf3f54e1f51809b8f99cae2623057feae74633314fbd7a2d29ce0beebe4d52ad57dc547792ab8162447725a602ae25d
SSDEEP

384:SLm1EKZOw/XDfm8KPJLE1w8NWx3TCXLtkUa5M5BQCn:euI+rjKPJE5s32XLtPqM53

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/3056-0-0x0000000010000000-0x0000000010010000-memory.dmp	upx
behavioral1/memory/3056-3-0x0000000010000000-0x0000000010010000-memory.dmp	upx
behavioral1/memory/3056-2-0x0000000010000000-0x0000000010010000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 3056	2356	rundll32.exe	29
PID 2356 wrote to memory of 3056	2356	rundll32.exe	29
PID 2356 wrote to memory of 3056	2356	rundll32.exe	29
PID 2356 wrote to memory of 3056	2356	rundll32.exe	29
PID 2356 wrote to memory of 3056	2356	rundll32.exe	29
PID 2356 wrote to memory of 3056	2356	rundll32.exe	29
PID 2356 wrote to memory of 3056	2356	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c58e6a2c7a6e569cda51aad2efd64511.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c58e6a2c7a6e569cda51aad2efd64511.dll,#1
  2⤵
  PID:3056

memory/3056-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/3056-3-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/3056-2-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download