7b90f0fdae5ff6817a55a06ebbb690669bc2d5be9dd464cde99e3fb73205fe23

Analysis

max time kernel
122s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-03-2024 19:45

Target

c977ed2abd6d5f0082ea4b928e1f7612.dll
Size

67KB
MD5

c977ed2abd6d5f0082ea4b928e1f7612
SHA1

568957a01102d9d2c0202a2a2b7eacf49d948b2f
SHA256

7b90f0fdae5ff6817a55a06ebbb690669bc2d5be9dd464cde99e3fb73205fe23
SHA512

9f52865330544d6f91bb322a44664daea4b0f118d6dad3b368e3b2f31d2e607736cf016191cea2932cf6ab0d419d78210842d8e41f6990fb85bf7d3b3f1eb5c6
SSDEEP

1536:LkywKbaTnslMxq9/I67wnuBBe8VBpKgm4Ug/QnPc:iTTnsMxq117w04UBplm4tQnU

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1468-0-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1468	1960	rundll32.exe	28
PID 1960 wrote to memory of 1468	1960	rundll32.exe	28
PID 1960 wrote to memory of 1468	1960	rundll32.exe	28
PID 1960 wrote to memory of 1468	1960	rundll32.exe	28
PID 1960 wrote to memory of 1468	1960	rundll32.exe	28
PID 1960 wrote to memory of 1468	1960	rundll32.exe	28
PID 1960 wrote to memory of 1468	1960	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c977ed2abd6d5f0082ea4b928e1f7612.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c977ed2abd6d5f0082ea4b928e1f7612.dll,#1
  2⤵
  PID:1468

memory/1468-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1468-1-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download