e7fbf2b770aa59a99a38ec5af08e02b82735b57e5f5436e822e8678100f7b884

Analysis

max time kernel
164s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 02:54

Target

012dd35ec6fd4798794ad75019e3a9db.dll
Size

476KB
MD5

012dd35ec6fd4798794ad75019e3a9db
SHA1

f0f2b1aaaf66867b58d787f305e2faf22521230a
SHA256

e7fbf2b770aa59a99a38ec5af08e02b82735b57e5f5436e822e8678100f7b884
SHA512

2c60293d00e7f52c3401900146529109fc037a23d10577b224f06fbcca2edb99e2983893f8f0a5c59ddf6c824f024a5f3e60440056281550cde4d67f601a6287
SSDEEP

12288:3QPe6coDdkJmHB32s3Nsevo0TKJvg1x3BYzr3LLs6tP9HU1LwACX4:3QPe6NDIB0N1ohav8rLLs6t9Ro

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2940-0-0x0000000000400000-0x0000000000477000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 2940	556	rundll32.exe	88
PID 556 wrote to memory of 2940	556	rundll32.exe	88
PID 556 wrote to memory of 2940	556	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\012dd35ec6fd4798794ad75019e3a9db.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\012dd35ec6fd4798794ad75019e3a9db.dll,#1
  2⤵
  PID:2940

memory/2940-0-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download