44fce8ba1e781cefd0706dd4a18ea6ec2b923471c8157bcc6f650df08aa8a12a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 10:32

Target

44fce8ba1e781cefd0706dd4a18ea6ec2b923471c8157bcc6f650df08aa8a12a.dll
Size

18KB
MD5

d9caec8b25e5080767041d589c03582c
SHA1

5e3be9c29b4d749aa21bfaecfd1cefd985931b9b
SHA256

44fce8ba1e781cefd0706dd4a18ea6ec2b923471c8157bcc6f650df08aa8a12a
SHA512

b53ac5424b5013c9c730059efa42f29fa759f3e34a745aa2555e155cb6125b8aa014ac4a0547af57c5e5733e40ed4746b641498e5e23526729f098571f6c2d67
SSDEEP

384:Tw9EmBsVs/WngViktDyUx5aNJawcudoD7Un/RY7RPWaw5W:E9Zc7aDy3nbcuyD7Uy7Q

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2132-3-0x0000000074C40000-0x0000000074C69000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2132	2104	rundll32.exe	28
PID 2104 wrote to memory of 2132	2104	rundll32.exe	28
PID 2104 wrote to memory of 2132	2104	rundll32.exe	28
PID 2104 wrote to memory of 2132	2104	rundll32.exe	28
PID 2104 wrote to memory of 2132	2104	rundll32.exe	28
PID 2104 wrote to memory of 2132	2104	rundll32.exe	28
PID 2104 wrote to memory of 2132	2104	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44fce8ba1e781cefd0706dd4a18ea6ec2b923471c8157bcc6f650df08aa8a12a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\44fce8ba1e781cefd0706dd4a18ea6ec2b923471c8157bcc6f650df08aa8a12a.dll,#1
  2⤵
  PID:2132

memory/2132-2-0x0000000074D80000-0x0000000074DA9000-memory.dmp

Filesize
164KB

Download
memory/2132-3-0x0000000074C40000-0x0000000074C69000-memory.dmp

Filesize
164KB

Download
memory/2132-1-0x0000000074D60000-0x0000000074D89000-memory.dmp

Filesize
164KB

Download
memory/2132-0-0x0000000074D90000-0x0000000074DB9000-memory.dmp

Filesize
164KB

Download