ee48174864ae0ef8c1e2da6b91b17c2f1df32195f69173adcc3013bf97c76ad5

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 16:54

Target

abb979296b15798893029044f06c97a2e98f4ec044c0c34ac27a0dd6bb0b0ff1.dll
Size

59KB
MD5

dc19a7e07efe444f97cb045e72492eaa
SHA1

3ed8226d1ec92c861d470477556f016a4f9d59e6
SHA256

abb979296b15798893029044f06c97a2e98f4ec044c0c34ac27a0dd6bb0b0ff1
SHA512

943c597fb766a3ad840975ed9197569cb8fcb27e8f7964f5e9f6b66ddf3653c316c9dd28ff5723e789aa8910f14185a0868da92e93bef4ebc36b098687518bf3
SSDEEP

1536:I0WP1ktawb9iV21ecrAYB3YuDBn1sYfI:IPcj+puDB1sYw

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral16/memory/2832-2-0x0000000074B60000-0x0000000074BB3000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1948 wrote to memory of 2832	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 2832	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 2832	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 2832	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 2832	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 2832	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 2832	1948	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\abb979296b15798893029044f06c97a2e98f4ec044c0c34ac27a0dd6bb0b0ff1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\abb979296b15798893029044f06c97a2e98f4ec044c0c34ac27a0dd6bb0b0ff1.dll,#1
2⤵
PID:2832

memory/2832-0-0x0000000074BD0000-0x0000000074C23000-memory.dmp

Filesize
332KB

Download
memory/2832-1-0x0000000074B70000-0x0000000074BC3000-memory.dmp

Filesize
332KB

Download
memory/2832-2-0x0000000074B60000-0x0000000074BB3000-memory.dmp

Filesize
332KB

Download