ac4d89af582fa47bf8fe8e0190f52e35ec644a6ff447fdc40b26debc4d951b9f

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 11:10

Target

c5ba075c7b33c6043690c49e16012fcc.dll
Size

248KB
MD5

c5ba075c7b33c6043690c49e16012fcc
SHA1

bb4d712ca74a7b1045e894a76f3f0cc89b2ece99
SHA256

ac4d89af582fa47bf8fe8e0190f52e35ec644a6ff447fdc40b26debc4d951b9f
SHA512

f7ef38274457f586263159d177cfe538a312aa4bf867f953350d7031a88712e26698bbde3d3ed13f87abec2e06c8f3ac3dcaf0546c5c009d2fa4b7491b08fc3c
SSDEEP

3072:039/0XQTfHpM6KeQVkc4SoC7/Z/wu+6OiqDhoyekrhlu:HATpMJeskcxoCDONimoye2zu

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2916-2-0x0000000010000000-0x000000001009E000-memory.dmp	upx
behavioral1/memory/2916-3-0x0000000010000000-0x000000001009E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2916	2872	rundll32.exe	28
PID 2872 wrote to memory of 2916	2872	rundll32.exe	28
PID 2872 wrote to memory of 2916	2872	rundll32.exe	28
PID 2872 wrote to memory of 2916	2872	rundll32.exe	28
PID 2872 wrote to memory of 2916	2872	rundll32.exe	28
PID 2872 wrote to memory of 2916	2872	rundll32.exe	28
PID 2872 wrote to memory of 2916	2872	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5ba075c7b33c6043690c49e16012fcc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5ba075c7b33c6043690c49e16012fcc.dll,#1
  2⤵
  PID:2916

memory/2916-1-0x0000000010000000-0x000000001009E000-memory.dmp

Filesize
632KB

Download
memory/2916-2-0x0000000010000000-0x000000001009E000-memory.dmp

Filesize
632KB

Download
memory/2916-3-0x0000000010000000-0x000000001009E000-memory.dmp

Filesize
632KB

Download
memory/2916-4-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download