964bf823d0bfa6b957c79f0e41d6efac27104e9aa9f5756d5ae69167491c7f7e

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 21:14

Target

964bf823d0bfa6b957c79f0e41d6efac27104e9aa9f5756d5ae69167491c7f7e.dll
Size

43KB
MD5

785fc2866b436a9ad6d395d4e9f161ec
SHA1

4b0b2af492c175dcaafa966711a6eef1899b9b9e
SHA256

964bf823d0bfa6b957c79f0e41d6efac27104e9aa9f5756d5ae69167491c7f7e
SHA512

ddba96573a5673f2b09c7c4caf3ad7654709a5111a2ab86d84aca1379c2585542be1ff4485af9d7376df4f7a9fee42e539ecad8c35f745b34a7c69f2789a654f
SSDEEP

768:lfeHhntWfnMkoCAYFEAcTj/MNsxS7iv6/Fw9TLv7AnbcuyD7UA:teHhsfnMkdV6/Mh7ii/FqLknouy8A

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/912-1-0x0000000075480000-0x000000007549E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 912	824	rundll32.exe	28
PID 824 wrote to memory of 912	824	rundll32.exe	28
PID 824 wrote to memory of 912	824	rundll32.exe	28
PID 824 wrote to memory of 912	824	rundll32.exe	28
PID 824 wrote to memory of 912	824	rundll32.exe	28
PID 824 wrote to memory of 912	824	rundll32.exe	28
PID 824 wrote to memory of 912	824	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\964bf823d0bfa6b957c79f0e41d6efac27104e9aa9f5756d5ae69167491c7f7e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\964bf823d0bfa6b957c79f0e41d6efac27104e9aa9f5756d5ae69167491c7f7e.dll,#1
  2⤵
  PID:912

memory/912-0-0x00000000754A0000-0x00000000754BE000-memory.dmp

Filesize
120KB

Download
memory/912-2-0x00000000754A0000-0x00000000754B3000-memory.dmp

Filesize
76KB

Download
memory/912-1-0x0000000075480000-0x000000007549E000-memory.dmp

Filesize
120KB

Download
memory/912-3-0x0000000075480000-0x000000007549E000-memory.dmp

Filesize
120KB

Download