71885b4338fb150a3ec97f4a17098f92122a25518bc36ccca5b5993bbb71bda8

Analysis

max time kernel
151s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
23/09/2023, 05:37

Target

71885b4338fb150a3ec97f4a17098f92122a25518bc36ccca5b5993bbb71bda8.dll
Size

1.6MB
MD5

f28192696294fa1dc19332d612bf2122
SHA1

bf1dd9910310b7914b6f92c96692b2074fd25bb2
SHA256

71885b4338fb150a3ec97f4a17098f92122a25518bc36ccca5b5993bbb71bda8
SHA512

2fb40dd8f913252024b4bf89c9fee02dd35c36d818f33d235dd8d39f58ece040e2cc010af0eabc8e838adf929ec9f9a6613445ab7b457e5c5f7b39387a2e4959
SSDEEP

24576:bq0PpSjgpQZZmJBx+g3UrxkGMmL+js+3Wvpw8x+UdNNBo44xS7LyAVnipiFVt8lO:Z0MQ3M9S+mL+Z3Wvpw8x+UPMElH3tUO

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4244-0-0x0000000010000000-0x000000001033B000-memory.dmp	upx
behavioral2/memory/4244-2-0x00000000028B0000-0x00000000028BB000-memory.dmp	upx
behavioral2/memory/4244-3-0x00000000028B0000-0x00000000028BB000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4244	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 4244	2240	rundll32.exe	86
PID 2240 wrote to memory of 4244	2240	rundll32.exe	86
PID 2240 wrote to memory of 4244	2240	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\71885b4338fb150a3ec97f4a17098f92122a25518bc36ccca5b5993bbb71bda8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\71885b4338fb150a3ec97f4a17098f92122a25518bc36ccca5b5993bbb71bda8.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4244

memory/4244-0-0x0000000010000000-0x000000001033B000-memory.dmp

Filesize
3.2MB

Download
memory/4244-2-0x00000000028B0000-0x00000000028BB000-memory.dmp

Filesize
44KB

Download
memory/4244-3-0x00000000028B0000-0x00000000028BB000-memory.dmp

Filesize
44KB

Download