d10170fbf64896d85e82ad93b95110b717498e4d3b76f5a59330aecef75ace48

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
07/07/2024, 03:49

Target

d10170fbf64896d85e82ad93b95110b717498e4d3b76f5a59330aecef75ace48.dll
Size

31KB
MD5

13c410666576dd512c932bd55b8f38d0
SHA1

b05d617e507f636475ed437f96e6fb76689b7ce0
SHA256

d10170fbf64896d85e82ad93b95110b717498e4d3b76f5a59330aecef75ace48
SHA512

96ed1dc108e88ac8ef1ad79a9844da77fb198a8afdc95e9ad6c0aaab26fb56498f892dea53a6b22027d3552211f0e2a96c87eab4bcaded319a48b7162a8d057b
SSDEEP

768:iiR0d8iG4xqtlEse6YOCejka9uW4WabkCkpJ45XpukF+uX:10h4lIdhe19uWs8KXpP+uX

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1844-1-0x0000000074860000-0x0000000074875000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 1844	2244	rundll32.exe	28
PID 2244 wrote to memory of 1844	2244	rundll32.exe	28
PID 2244 wrote to memory of 1844	2244	rundll32.exe	28
PID 2244 wrote to memory of 1844	2244	rundll32.exe	28
PID 2244 wrote to memory of 1844	2244	rundll32.exe	28
PID 2244 wrote to memory of 1844	2244	rundll32.exe	28
PID 2244 wrote to memory of 1844	2244	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d10170fbf64896d85e82ad93b95110b717498e4d3b76f5a59330aecef75ace48.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d10170fbf64896d85e82ad93b95110b717498e4d3b76f5a59330aecef75ace48.dll,#1
  2⤵
  PID:1844

memory/1844-0-0x0000000074880000-0x0000000074895000-memory.dmp

Filesize
84KB

Download
memory/1844-3-0x0000000074860000-0x0000000074875000-memory.dmp

Filesize
84KB

Download
memory/1844-2-0x0000000074880000-0x0000000074895000-memory.dmp

Filesize
84KB

Download
memory/1844-1-0x0000000074860000-0x0000000074875000-memory.dmp

Filesize
84KB

Download