5b731e23be406f4b0e0908bccfba25798fa5fff5695191de760fe385a538688b

Analysis

max time kernel
1559s
max time network
1561s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20-07-2024 14:23

Target

bro what the fuckkk ur seriously beliving that.dll
Size

123KB
MD5

21147329bec4cbc1c6fce80297974696
SHA1

c8c0065c7fc7336cef5bb2f4368724b36d7e4fa7
SHA256

e5209b13acdaff500e51c049a436710dd794ea027286b0a6c7c41426471194c2
SHA512

f025948a3d8086e2ef8834d8d29fd3d717f2500d071e4a0f47db5cba1f01214e8b15e392e2e0a0925767b21e630edfea92bee5653297e2beacabfc1a0e23bc50
SSDEEP

3072:K7dDRBM7qvXAv/8low26slwGNktA8o1QI3:M7uqfs8lo9quktA8VU

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral7/memory/2868-3-0x0000000074F70000-0x0000000074FF1000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2396 wrote to memory of 2868	2396	rundll32.exe	rundll32.exe
PID 2396 wrote to memory of 2868	2396	rundll32.exe	rundll32.exe
PID 2396 wrote to memory of 2868	2396	rundll32.exe	rundll32.exe
PID 2396 wrote to memory of 2868	2396	rundll32.exe	rundll32.exe
PID 2396 wrote to memory of 2868	2396	rundll32.exe	rundll32.exe
PID 2396 wrote to memory of 2868	2396	rundll32.exe	rundll32.exe
PID 2396 wrote to memory of 2868	2396	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\bro what the fuckkk ur seriously beliving that.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2396

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\bro what the fuckkk ur seriously beliving that.dll",#1
2⤵
PID:2868

memory/2868-0-0x0000000074F80000-0x0000000075001000-memory.dmp

Filesize
516KB

Download
memory/2868-1-0x0000000074EF0000-0x0000000074F71000-memory.dmp

Filesize
516KB

Download
memory/2868-3-0x0000000074F70000-0x0000000074FF1000-memory.dmp

Filesize
516KB

Download
memory/2868-2-0x0000000074F60000-0x0000000074FE1000-memory.dmp

Filesize
516KB

Download