ddb62fe8611e6e37b8b37413dea5e5f813f441e1601f8c805787a2d94265a8cb

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 11:56

Target

office2019pjb_9435/office2019pjb/OTool/files/Thunder/download_engine.dll
Size

875KB
MD5

c818df90f4eda9a4a048dd656d0a4ea7
SHA1

79d66f736df36b689ae9c3c4fd382d15f1dbcdba
SHA256

677596b043cfe0bcacf19d60ba202696b95830adecdeb2a3054fc625479623ec
SHA512

21382150e1ccf35559c1929d0fb482a9361cff869b500ceaa9c0a07928a66fa9fd28b767346877ffb02b87eea8b3e6e00f658c02243b33cd860adc288c7f600c
SSDEEP

24576:3Ong+jST5mDj6BJGOz36LAtvhb6t6x+8Bv1a:NzM3uZz368tvJ91a

Score

7^/10

upx

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral17/memory/1880-5-0x00000000215B0000-0x00000000215C6000-memory.dmp	upx
behavioral17/memory/1880-4-0x0000000010000000-0x0000000010383000-memory.dmp	upx
behavioral17/memory/1880-3-0x00000000215B0000-0x00000000215C6000-memory.dmp	upx
behavioral17/memory/1880-1-0x0000000010000000-0x0000000010383000-memory.dmp	upx
behavioral17/memory/1880-2-0x0000000010000000-0x0000000010383000-memory.dmp	upx
behavioral17/memory/1880-0-0x0000000010000000-0x0000000010383000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 1880	2216	rundll32.exe	28
PID 2216 wrote to memory of 1880	2216	rundll32.exe	28
PID 2216 wrote to memory of 1880	2216	rundll32.exe	28
PID 2216 wrote to memory of 1880	2216	rundll32.exe	28
PID 2216 wrote to memory of 1880	2216	rundll32.exe	28
PID 2216 wrote to memory of 1880	2216	rundll32.exe	28
PID 2216 wrote to memory of 1880	2216	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\office2019pjb_9435\office2019pjb\OTool\files\Thunder\download_engine.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\office2019pjb_9435\office2019pjb\OTool\files\Thunder\download_engine.dll,#1
  2⤵
  PID:1880

memory/1880-5-0x00000000215B0000-0x00000000215C6000-memory.dmp

Filesize
88KB

Download
memory/1880-4-0x0000000010000000-0x0000000010383000-memory.dmp

Filesize
3.5MB

Download
memory/1880-3-0x00000000215B0000-0x00000000215C6000-memory.dmp

Filesize
88KB

Download
memory/1880-1-0x0000000010000000-0x0000000010383000-memory.dmp

Filesize
3.5MB

Download
memory/1880-2-0x0000000010000000-0x0000000010383000-memory.dmp

Filesize
3.5MB

Download
memory/1880-0-0x0000000010000000-0x0000000010383000-memory.dmp

Filesize
3.5MB

Download