863f6255cf7fcf235c8eedacbbc7b4746853e08aa79f2a0b126925ede94e1a88

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 18:28

Target

0bdd59b3fdad89b2187d5cda30c62e01.dll
Size

12KB
MD5

0bdd59b3fdad89b2187d5cda30c62e01
SHA1

5347e4df50356b48eaee0212a3ca7dcc2102e3d6
SHA256

863f6255cf7fcf235c8eedacbbc7b4746853e08aa79f2a0b126925ede94e1a88
SHA512

3ebcb9a048e3680668dd4f81d7808623111ef78dcf89316ab0904c620004ee6ffdc2eeca724ab46eae4c34bf52595783132b2ed685710e4c43579946f5f3bc26
SSDEEP

192:yvQqQLVXh8gaFLKlcMsDBe4dGTLlPG4pdAaTXdjjBxXp4eh6JhU89zvE4:yvaVmzFLNDDBe9TLlb7Xdjjrns+8tv

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4980-0-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 4980	4512	rundll32.exe	14
PID 4512 wrote to memory of 4980	4512	rundll32.exe	14
PID 4512 wrote to memory of 4980	4512	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0bdd59b3fdad89b2187d5cda30c62e01.dll,#1
1⤵
PID:4980

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0bdd59b3fdad89b2187d5cda30c62e01.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4512

memory/4980-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download