1436837ffca0ae14a4a78094712bde49fe4aa056cdba9885d4980863cebc139b

Analysis

max time kernel
141s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 03:17

Target

59b08c0c6e8516d65a7a8bd02bce6bb6.dll
Size

364KB
MD5

59b08c0c6e8516d65a7a8bd02bce6bb6
SHA1

1a0226539a35acc482c58c8488f0ba26c369dd85
SHA256

1436837ffca0ae14a4a78094712bde49fe4aa056cdba9885d4980863cebc139b
SHA512

8dee8cc06b33986a3aab8c75bf871c9c13041a36f29ccb4574588958213db92dcb747b19b2c87a653b30683ed99a658fa73512600c344a97d182f30365c13245
SSDEEP

6144:SUAJ+OOYy2gFf3wdoV6bewJAC+KjWN+fAPA25NmbLTtVpoRN6iPHZep4++c:pAJSJbyoVuewC7KjWN+fAPbDSkwKep

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/700-0-0x0000000074950000-0x00000000749BD000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 700	4944	rundll32.exe	88
PID 4944 wrote to memory of 700	4944	rundll32.exe	88
PID 4944 wrote to memory of 700	4944	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59b08c0c6e8516d65a7a8bd02bce6bb6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59b08c0c6e8516d65a7a8bd02bce6bb6.dll,#1
  2⤵
  PID:700

memory/700-0-0x0000000074950000-0x00000000749BD000-memory.dmp

Filesize
436KB

Download