799b562d069a940c5fca342d56bc8f48b18086f9e8f535c4ec06be33d11894f4

Analysis

max time kernel
95s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 04:09

Target

0489056c3c8e54e960798f644c3330bd.dll
Size

61KB
MD5

0489056c3c8e54e960798f644c3330bd
SHA1

2a6c5de2251608ef566d1ba83a6d464d68f785ab
SHA256

799b562d069a940c5fca342d56bc8f48b18086f9e8f535c4ec06be33d11894f4
SHA512

c3078f8f29dcdc2686aadd026afbb2bd0d64af5de83daae4eb0334e8301760d6c6dec7a07e1abe7c6227000efe51dd1a77032dac24bc9084cf5870b0764ac863
SSDEEP

1536:V8O9Nn6RjrinPuQ/4jHosHk4VmVSYyqWIV1W/iNUrjNSLSuWtdq3:2Oz6VWWQKHtRmVSlf1/rrjNptM3

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/744-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 744	2648	rundll32.exe	77
PID 2648 wrote to memory of 744	2648	rundll32.exe	77
PID 2648 wrote to memory of 744	2648	rundll32.exe	77

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0489056c3c8e54e960798f644c3330bd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0489056c3c8e54e960798f644c3330bd.dll,#1
  2⤵
  PID:744

memory/744-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download