8b95bd5d01d016c0d1a8780197ce5bda5fde401b6e598c090b2f1cd1cc2edade

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 04:14

Target

8b95bd5d01d016c0d1a8780197ce5bda5fde401b6e598c090b2f1cd1cc2edade.dll
Size

27KB
MD5

b846ffd133ab2b091a5f7594259b26ec
SHA1

6760e4a37e025a9915d8ebb2273a9a4e317442c2
SHA256

8b95bd5d01d016c0d1a8780197ce5bda5fde401b6e598c090b2f1cd1cc2edade
SHA512

8744df399855a872471696b95b98b8856bdda3df3136991616bf77684795374de5e019caed1194b79bc61d4e77e2fbeadf83c93b81f445b981dcbb01854ee1dc
SSDEEP

768:IPy9Ck6BFP9wZ2brjmazQDnbcuyD7Upf:qy4k8lJrjDz2nouy85

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4912-0-0x0000000074FE0000-0x0000000074FF8000-memory.dmp	upx
behavioral2/memory/4912-1-0x0000000074FE0000-0x0000000074FF8000-memory.dmp	upx
behavioral2/memory/4912-2-0x0000000074FE0000-0x0000000074FF8000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 4912	4532	rundll32.exe	86
PID 4532 wrote to memory of 4912	4532	rundll32.exe	86
PID 4532 wrote to memory of 4912	4532	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8b95bd5d01d016c0d1a8780197ce5bda5fde401b6e598c090b2f1cd1cc2edade.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8b95bd5d01d016c0d1a8780197ce5bda5fde401b6e598c090b2f1cd1cc2edade.dll,#1
  2⤵
  PID:4912

memory/4912-0-0x0000000074FE0000-0x0000000074FF8000-memory.dmp

Filesize
96KB

Download
memory/4912-1-0x0000000074FE0000-0x0000000074FF8000-memory.dmp

Filesize
96KB

Download
memory/4912-2-0x0000000074FE0000-0x0000000074FF8000-memory.dmp

Filesize
96KB

Download