4324fb787a2cf92fddcc9e8bb97f299539d991b86b2e3ef618141e56278ee424

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 20:12

Target

GZIP.dll
Size

19KB
MD5

d06d3ed9ad9b3a9bc644ffe4729a03cd
SHA1

d58aa41517ca8765365ec498ab3be79a2a7bab80
SHA256

c875f8b2db2a1c89ee76d6f2e4431be63d728e8d7edc2635df2d3ce1b9f8cb73
SHA512

124c8d2f09026a8f64e5b3822b3c40a6282c93f914d15f8902bb76775ff0d59d4e395fdd79673865f3739562c6fa7ed23d1fa5dad6969954768188013e689fcb
SSDEEP

384:JMTnIZMZlfoMfrPhyza/Ig3AEjctMQWxoy5XbkLWX:YtfoMjPhyzaDAe9QReXbz

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral3/memory/2060-3-0x0000000068CD0000-0x0000000068CDF000-memory.dmp	upx
behavioral3/memory/2060-2-0x0000000068CD0000-0x0000000068CDF000-memory.dmp	upx
behavioral3/memory/2060-0-0x0000000068CD0000-0x0000000068CDF000-memory.dmp	upx
behavioral3/memory/2060-4-0x0000000068CD0000-0x0000000068CDF000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1708	2060	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2060	2132	rundll32.exe	28
PID 2132 wrote to memory of 2060	2132	rundll32.exe	28
PID 2132 wrote to memory of 2060	2132	rundll32.exe	28
PID 2132 wrote to memory of 2060	2132	rundll32.exe	28
PID 2132 wrote to memory of 2060	2132	rundll32.exe	28
PID 2132 wrote to memory of 2060	2132	rundll32.exe	28
PID 2132 wrote to memory of 2060	2132	rundll32.exe	28
PID 2060 wrote to memory of 1708	2060	rundll32.exe	29
PID 2060 wrote to memory of 1708	2060	rundll32.exe	29
PID 2060 wrote to memory of 1708	2060	rundll32.exe	29
PID 2060 wrote to memory of 1708	2060	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GZIP.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\GZIP.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 224
    3⤵
    - Program crash
    PID:1708

memory/2060-3-0x0000000068CD0000-0x0000000068CDF000-memory.dmp

Filesize
60KB

Download
memory/2060-2-0x0000000068CD0000-0x0000000068CDF000-memory.dmp

Filesize
60KB

Download
memory/2060-1-0x0000000068CD0000-0x0000000068CDF000-memory.dmp

Filesize
60KB

Download
memory/2060-0-0x0000000068CD0000-0x0000000068CDF000-memory.dmp

Filesize
60KB

Download
memory/2060-4-0x0000000068CD0000-0x0000000068CDF000-memory.dmp

Filesize
60KB

Download