77ec2cb1ed9f30ea478998e3150290168fd229f8de717ecb526b1af06ec3fb86

Analysis

max time kernel
146s
max time network
68s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 02:36

Target

004daac951d13e67c59262c25db985e9.dll
Size

198KB
MD5

004daac951d13e67c59262c25db985e9
SHA1

0a82dabe028ef0565a20c2693784ad53acff389a
SHA256

77ec2cb1ed9f30ea478998e3150290168fd229f8de717ecb526b1af06ec3fb86
SHA512

8e889e70306cfe69da3d7fd52286423d8688f9a6c38421c5aa70d6ea1b1582221869a0e8b7a3f2a64b1c34afebfbe51d12426e2bed42e938db79d6416d4f6435
SSDEEP

3072:5Q10/5j01aXteQzWXcvYpMNPmOjmUOImf6OsWunItPR2oNwBZt:5Q1rpMNPvjeI6vpPR2o8Zt

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4756-0-0x0000000010000000-0x0000000010032000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 4756	2328	rundll32.exe	14
PID 2328 wrote to memory of 4756	2328	rundll32.exe	14
PID 2328 wrote to memory of 4756	2328	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\004daac951d13e67c59262c25db985e9.dll,#1
1⤵
PID:4756

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\004daac951d13e67c59262c25db985e9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2328

memory/4756-0-0x0000000010000000-0x0000000010032000-memory.dmp

Filesize
200KB

Download