e601c8f7d7807dda184c4f8798770f246621a82e418cbbf7908ff340e155bf6f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 07:21

Target

d588d000dc2e75a35245b34ff610420b.dll
Size

12KB
MD5

d588d000dc2e75a35245b34ff610420b
SHA1

db09418290145c703013e3e94eebf47f4313bcff
SHA256

e601c8f7d7807dda184c4f8798770f246621a82e418cbbf7908ff340e155bf6f
SHA512

758aedcc7e8cd7e40159110ea7f191cdd801a65ee470d4157940c5ddc6c537c78bf76ef52ed8cc65c10b2c445197077df68f634e92b803150393622f11884cec
SSDEEP

192:DDXcZ35QSB2aFjZoxtxrOrjEzNl7UMFxpSK5kCo+imBxqssHqJ23l8LgbVTpWJn:DD05QSlGxr7kMJ22dvsKJ23hbVTpW

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1952-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx
behavioral1/memory/1952-1-0x0000000010000000-0x000000001000D000-memory.dmp	upx
behavioral1/memory/1952-2-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 1952	2484	rundll32.exe	28
PID 2484 wrote to memory of 1952	2484	rundll32.exe	28
PID 2484 wrote to memory of 1952	2484	rundll32.exe	28
PID 2484 wrote to memory of 1952	2484	rundll32.exe	28
PID 2484 wrote to memory of 1952	2484	rundll32.exe	28
PID 2484 wrote to memory of 1952	2484	rundll32.exe	28
PID 2484 wrote to memory of 1952	2484	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d588d000dc2e75a35245b34ff610420b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d588d000dc2e75a35245b34ff610420b.dll,#1
  2⤵
  PID:1952

memory/1952-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/1952-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/1952-2-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download