fa09a02a6186df75b4d054e55adb9b7d68a5989496a11a5d147f64a905f4d041

Analysis

max time kernel
93s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2023, 14:57

Target

9870d1d2f4772932e1b2bb68732610b0_dll32_JC.dll
Size

351KB
MD5

9870d1d2f4772932e1b2bb68732610b0
SHA1

43bbf795cbbf79476a42d261db922e9af9501cf0
SHA256

fa09a02a6186df75b4d054e55adb9b7d68a5989496a11a5d147f64a905f4d041
SHA512

6856a24a78b4671b6d571ab90c158c5b5050afab7b7b4bc3b1acf23eabd867a63e49ffa87477bd6b0cf61d508d058944bc284bfc57e97f7c9ebfb9c3618b55ea
SSDEEP

6144:8BtARd7OLgxGhZs7t/El9zO07aC1Dt3jsrRHglzY4ALjxTaiunwwzYcTpc:+tuJO5Ds7tcJOS1h3IVHglUpjQ5pc

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2876-0-0x0000000074B80000-0x0000000074CAC000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 2876	4052	rundll32.exe	83
PID 4052 wrote to memory of 2876	4052	rundll32.exe	83
PID 4052 wrote to memory of 2876	4052	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9870d1d2f4772932e1b2bb68732610b0_dll32_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9870d1d2f4772932e1b2bb68732610b0_dll32_JC.dll,#1
  2⤵
  PID:2876

memory/2876-0-0x0000000074B80000-0x0000000074CAC000-memory.dmp

Filesize
1.2MB

Download