31d7153973c74b63be208b632160f46e5760303a19d70d97a67a348c4e1aec47

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/04/2024, 14:38

Target

31d7153973c74b63be208b632160f46e5760303a19d70d97a67a348c4e1aec47.dll
Size

65KB
MD5

bc478c5119446930cf7dcfe6b94a6b50
SHA1

ec7c9afaf8f86cc5bc7613668cf9b1cddecb6e6b
SHA256

31d7153973c74b63be208b632160f46e5760303a19d70d97a67a348c4e1aec47
SHA512

cedf6f158b791dba3d40fab10f3b6cf5f66ab0e31a749fd38a4b9824ae048cf45f27f0a87ba367e01c809b1e839f7ce37404062915e0f922e4c34eb85fb4f051
SSDEEP

1536:EHIftZYu+6MgEkOKOXcUBabves63mVXU5XrDW:WIYu+PgR2ga21Utq

Score

9^/10

upx

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral1/memory/2264-0-0x0000000010000000-0x0000000010012000-memory.dmp	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2264-0-0x0000000010000000-0x0000000010012000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2264	2936	rundll32.exe	28
PID 2936 wrote to memory of 2264	2936	rundll32.exe	28
PID 2936 wrote to memory of 2264	2936	rundll32.exe	28
PID 2936 wrote to memory of 2264	2936	rundll32.exe	28
PID 2936 wrote to memory of 2264	2936	rundll32.exe	28
PID 2936 wrote to memory of 2264	2936	rundll32.exe	28
PID 2936 wrote to memory of 2264	2936	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31d7153973c74b63be208b632160f46e5760303a19d70d97a67a348c4e1aec47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\31d7153973c74b63be208b632160f46e5760303a19d70d97a67a348c4e1aec47.dll,#1
  2⤵
  PID:2264

memory/2264-0-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download