4040003f1c2e98555506444cc8ac2d47c529fb3b119b649d70589557b7fea428

Analysis

max time kernel
137s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 04:50

Target

681829f54228f96eba60ecec070f6a13.dll
Size

44KB
MD5

681829f54228f96eba60ecec070f6a13
SHA1

e5d6b65ec4c34fb587b055526cda0b635d90e1f5
SHA256

4040003f1c2e98555506444cc8ac2d47c529fb3b119b649d70589557b7fea428
SHA512

7c4e1cf0e982e328646069af7ec20a0d3345764f3c4a9b22c55228910cbbce77cc18d63e428252934f33fca667d1fa937a03a529ae25a99560a3ce2a86b227ad
SSDEEP

768:xnOK+3JqS9V+dMCdSsAVlNmpB7w3PBGU+w73fCFxOqLMBH3fxa1Vu6dX4aGdnbcc:xnOHoSTtCd8Nmvs3PBGAva8qLMBHMFdk

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2460-0-0x0000000010000000-0x0000000010034000-memory.dmp	upx
behavioral2/memory/2460-2-0x0000000010000000-0x0000000010034000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\version1.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2460	2104	rundll32.exe	86
PID 2104 wrote to memory of 2460	2104	rundll32.exe	86
PID 2104 wrote to memory of 2460	2104	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\681829f54228f96eba60ecec070f6a13.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\681829f54228f96eba60ecec070f6a13.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2460

memory/2460-0-0x0000000010000000-0x0000000010034000-memory.dmp

Filesize
208KB

Download
memory/2460-2-0x0000000010000000-0x0000000010034000-memory.dmp

Filesize
208KB

Download