21c987df90c8ee602fdcdbfa3f76d56c05b21fe6bca505fe758a1c7c076b708b

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 20:24

Target

10bab67b0b24905922577fad2045defa.dll
Size

52KB
MD5

10bab67b0b24905922577fad2045defa
SHA1

57596e1786861f2fcbcc43ec1530d80a0bfc67bf
SHA256

21c987df90c8ee602fdcdbfa3f76d56c05b21fe6bca505fe758a1c7c076b708b
SHA512

0bdf2a22fcde170efd2393644ba4a9f0eed78f19d165dc809f3c4b766e53f0de7e0bbd8cb3ad384f6a4f965755ce2c042b1109f40aa69a342ef155a725a63704
SSDEEP

768:z3OHS8KOzT/WfTaBXOquCvA53W1nO9pLHNHhfQLPIRkSlR6K+d4Sa62FDjM:yHZ6mBexCk3W1nAFHkLslRWb12F3M

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3864-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 3864	1896	rundll32.exe	15
PID 1896 wrote to memory of 3864	1896	rundll32.exe	15
PID 1896 wrote to memory of 3864	1896	rundll32.exe	15

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\10bab67b0b24905922577fad2045defa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\10bab67b0b24905922577fad2045defa.dll,#1
  2⤵
  PID:3864

memory/3864-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download