11f74f7f81599b4d3399635c1c2a80ab3439ace9dd971ae302c6892ad0ef7497

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/03/2024, 12:45

Target

de0b3734819cd46d5bd18943b8ea252d.dll
Size

277KB
MD5

de0b3734819cd46d5bd18943b8ea252d
SHA1

f4270468ade87703125156e2bf1872296b03ee1f
SHA256

11f74f7f81599b4d3399635c1c2a80ab3439ace9dd971ae302c6892ad0ef7497
SHA512

a103c484a3e66e629d59fa862c32ccf98913846e343d479ca4bae5684f20c5a33152f31b493fc95a73aa9e036f5c4bb31016a4083efee68e411d7be2b3f704c8
SSDEEP

6144:oY/EchVK+wrlr4cZZ6tY8AZGACkCarjJmgffx2Z2c59ib/JsmoSG:vEcsrScZglAThJnffw9jkoSG

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1444-0-0x0000000010000000-0x00000000100A3000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1444	2012	rundll32.exe	28
PID 2012 wrote to memory of 1444	2012	rundll32.exe	28
PID 2012 wrote to memory of 1444	2012	rundll32.exe	28
PID 2012 wrote to memory of 1444	2012	rundll32.exe	28
PID 2012 wrote to memory of 1444	2012	rundll32.exe	28
PID 2012 wrote to memory of 1444	2012	rundll32.exe	28
PID 2012 wrote to memory of 1444	2012	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de0b3734819cd46d5bd18943b8ea252d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\de0b3734819cd46d5bd18943b8ea252d.dll,#1
  2⤵
  PID:1444

memory/1444-0-0x0000000010000000-0x00000000100A3000-memory.dmp

Filesize
652KB

Download
memory/1444-1-0x0000000010000000-0x00000000100A3000-memory.dmp

Filesize
652KB

Download