8415176d4dcd4170a5fb525717fc0ce16fa7a5471a562ec63b0a79b87a1a80c3

Analysis

max time kernel
63s
max time network
73s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2023, 04:56

Target

Desktop/app.cp38-win32(upx).dll
Size

155KB
MD5

0e16eebd2ed5a042d665e3cadb67b92b
SHA1

072d240df51881c79d618dcf4ee7a8c595eeea39
SHA256

92dcbc0560ae173e4152613874ffea7b1b87fcab7f1bcd17e1b5384ca2643de4
SHA512

468b43ce82de2faef0430c6f5192053cdda5934c62fec11b57cca0fbb7634880c339dd87837b1dee3f59147d6ec9d1418de00bcdb8bccc3895f895b1d588545a
SSDEEP

3072:6h1DUBRkkAkTcj9wUaqnOybytT49GIdFPKrhKSeFIpJn3out:CWw5RwPqndyODdxKrNempJn3oS

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral4/memory/3588-0-0x0000000074D30000-0x0000000074DB7000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 3588	1704	rundll32.exe	87
PID 1704 wrote to memory of 3588	1704	rundll32.exe	87
PID 1704 wrote to memory of 3588	1704	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Desktop\app.cp38-win32(upx).dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Desktop\app.cp38-win32(upx).dll,#1
  2⤵
  PID:3588

memory/3588-0-0x0000000074D30000-0x0000000074DB7000-memory.dmp

Filesize
540KB

Download