be7f9c6015c1bfff3173610ee1585d7d30df70c84c951b1ea429d7c004cad243

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/04/2024, 11:45

Target

BleachBit-Portable/freetype6.dll
Size

303KB
MD5

5a448da6e119e6af3694500f5ef82338
SHA1

db92db62304b22503863f9b8f5dbc7b14be3e7dc
SHA256

1dc8e799f65cd4619df0779a51bfa12fb2e11dd7bee5166bf92200b28e9aa3df
SHA512

a75083ee51343a4ec03d68bb10cfa654eec09ff424e57042d2a1d9d6d613724766ac1e65f3e85a51ae58b5b470b2a0b0afa5e8c0f289ba7ca9d4ed510d365503
SSDEEP

6144:PBJUMEHJkPJjyMyQ3V3vZ4kjzCa9+OJvKcEXIFKp0pDl60/IxDdX3fGbCqy:jUM+kPJjyMyQ3V35OovKZUa0pDlV0h//

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral21/memory/2564-1-0x000000006A800000-0x000000006A87E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2564	2720	rundll32.exe	27
PID 2720 wrote to memory of 2564	2720	rundll32.exe	27
PID 2720 wrote to memory of 2564	2720	rundll32.exe	27
PID 2720 wrote to memory of 2564	2720	rundll32.exe	27
PID 2720 wrote to memory of 2564	2720	rundll32.exe	27
PID 2720 wrote to memory of 2564	2720	rundll32.exe	27
PID 2720 wrote to memory of 2564	2720	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\BleachBit-Portable\freetype6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\BleachBit-Portable\freetype6.dll,#1
  2⤵
  PID:2564

memory/2564-0-0x000000006A800000-0x000000006A87E000-memory.dmp

Filesize
504KB

Download
memory/2564-1-0x000000006A800000-0x000000006A87E000-memory.dmp

Filesize
504KB

Download