545f14308861b994cacb28fa6ff25d2ff794bf3e9a7fb90355d7e890113aaf28

Analysis

max time kernel
120s
max time network
132s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
19-03-2024 20:49

Target

d715444029d06f02e48254e3c12e6343.dll
Size

39KB
MD5

d715444029d06f02e48254e3c12e6343
SHA1

a71298d3c595ad048ed7c63338cad7e0716d9dd3
SHA256

545f14308861b994cacb28fa6ff25d2ff794bf3e9a7fb90355d7e890113aaf28
SHA512

207287c16e335f51cf31765b0427b0245f407abe78c5a774ef9d3837d3a102986684b3787003646fdeab40b4410919c67b217f2b392b519b6eeba5f8060ce4b6
SSDEEP

384:ClXCSPF51+zlWFMYDLeVRtgdpuS44IQbIxCGGtF9HYPJr26:CAUF5fuYuVR2PuS443QKzqrb

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2128-0-0x0000000000400000-0x0000000000412000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2128	2124	rundll32.exe	28
PID 2124 wrote to memory of 2128	2124	rundll32.exe	28
PID 2124 wrote to memory of 2128	2124	rundll32.exe	28
PID 2124 wrote to memory of 2128	2124	rundll32.exe	28
PID 2124 wrote to memory of 2128	2124	rundll32.exe	28
PID 2124 wrote to memory of 2128	2124	rundll32.exe	28
PID 2124 wrote to memory of 2128	2124	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d715444029d06f02e48254e3c12e6343.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d715444029d06f02e48254e3c12e6343.dll,#1
  2⤵
  PID:2128

memory/2128-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2128-1-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download