0483b6fd2bd022fef07bf2509a2351292736966b975e68368cdb36bd4bd53c94

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 11:01

Target

df011fbfde579d65a82d9903fd92c362.dll
Size

64KB
MD5

df011fbfde579d65a82d9903fd92c362
SHA1

748254707a0e80690194494e3dc3503bb4b1017f
SHA256

0483b6fd2bd022fef07bf2509a2351292736966b975e68368cdb36bd4bd53c94
SHA512

a54f1193ee667f3f896cc1d1c7877550b68a68dbf3ed27f1e0719373690eb21c8831cd57d9b2136a461df2ddd8f134419b3a86e18b66ab119338a7dd24a8e0ec
SSDEEP

1536:F1WCNpXfmefiUIL1twqbhqdLR8zNJVrWYUAhSpDID:fpfiLUqbUGzHVrWl+SpDID

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2184-0-0x0000000000260000-0x000000000026E000-memory.dmp	upx
behavioral1/memory/2184-4-0x0000000000260000-0x000000000026E000-memory.dmp	upx
behavioral1/memory/2184-5-0x0000000000260000-0x000000000026E000-memory.dmp	upx
behavioral1/memory/2184-6-0x0000000000260000-0x000000000026E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2184	2172	rundll32.exe	28
PID 2172 wrote to memory of 2184	2172	rundll32.exe	28
PID 2172 wrote to memory of 2184	2172	rundll32.exe	28
PID 2172 wrote to memory of 2184	2172	rundll32.exe	28
PID 2172 wrote to memory of 2184	2172	rundll32.exe	28
PID 2172 wrote to memory of 2184	2172	rundll32.exe	28
PID 2172 wrote to memory of 2184	2172	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\df011fbfde579d65a82d9903fd92c362.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\df011fbfde579d65a82d9903fd92c362.dll,#1
  2⤵
  PID:2184

memory/2184-0-0x0000000000260000-0x000000000026E000-memory.dmp

Filesize
56KB

Download
memory/2184-2-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2184-4-0x0000000000260000-0x000000000026E000-memory.dmp

Filesize
56KB

Download
memory/2184-5-0x0000000000260000-0x000000000026E000-memory.dmp

Filesize
56KB

Download
memory/2184-7-0x0000000000261000-0x0000000000267000-memory.dmp

Filesize
24KB

Download
memory/2184-6-0x0000000000260000-0x000000000026E000-memory.dmp

Filesize
56KB

Download