f0312bb0e825e5786d08e93f63c1880fbae8f8cbc45f0955e2ea74becc3ef27e

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 11:31

Target

plugins/kanal.dll
Size

116KB
MD5

30c1b6d7ed23997e380be509e5849cf5
SHA1

552ec2619a3cad49721a197ebe029a931934fce3
SHA256

37765a23911158be8351781771758d0b7af3e8b6943ea97e32612ddb5e4e0272
SHA512

14ae99195a65bd85f6471c3cf5b86db4dff150c1c2f2007a285396c020397f953ca3de0c082e3d0b223c8bdb4f9dc4999a7276665855611d0e60892ba1dfe864
SSDEEP

3072:0YvfngSVA11RmbcOLCQkLuI0Gmb5bNkpeVp+rkO9c7vTVVrfjOkboutg:3gfHR5LuIeJqp7I775VbjvboSg

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral9/memory/2936-0-0x0000000018800000-0x0000000018837000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2936	2704	rundll32.exe	30
PID 2704 wrote to memory of 2936	2704	rundll32.exe	30
PID 2704 wrote to memory of 2936	2704	rundll32.exe	30
PID 2704 wrote to memory of 2936	2704	rundll32.exe	30
PID 2704 wrote to memory of 2936	2704	rundll32.exe	30
PID 2704 wrote to memory of 2936	2704	rundll32.exe	30
PID 2704 wrote to memory of 2936	2704	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\kanal.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\kanal.dll,#1
  2⤵
  PID:2936

memory/2936-0-0x0000000018800000-0x0000000018837000-memory.dmp

Filesize
220KB

Download