23d61746333dc2ddd646b953b695ffffe82079966d4a23927ce6cee249b95eaa

Analysis

max time kernel
182s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 04:15

Target
04b5656606bc41d76bc662a1d5f83cdc.dll
Size 96KB
Sample231225-evc9wsgaf7
SHA256 23d61746333dc2ddd646b953b695ffffe82079966d4a23927ce6cee249b95eaa
MD5 04b5656606bc41d76bc662a1d5f83cdc
SHA1 181e9e09f962969fe983519da63c5589c527fe1f
SHA512 ba95b6702b7d7f9b2b891770cafeb716e17517bc71597b8a145e4a73a65f25cd5765a2faf1026516e7577e239011ef972653ccf3b39d2c7e964ece1bd8540f7a
SSDEEP 1536:/r8Y7dNuuuFqwN+2cFHMAPzcfD4t+NihIfV7NmUuifKse+cJ336vwfe7XvGSYtVJ:z8YdNuuIN+ZFsALIEoNihIftFuifG+3c
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1708-0-0x00000000754F0000-0x0000000075516000-memory.dmp	upx
behavioral2/memory/1708-1-0x00000000754F0000-0x0000000075516000-memory.dmp	upx
behavioral2/memory/1708-2-0x00000000754F0000-0x0000000075516000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 1708	3356	rundll32.exe	89
PID 3356 wrote to memory of 1708	3356	rundll32.exe	89
PID 3356 wrote to memory of 1708	3356	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04b5656606bc41d76bc662a1d5f83cdc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\04b5656606bc41d76bc662a1d5f83cdc.dll,#1
  2⤵
  PID:1708

memory/1708-0-0x00000000754F0000-0x0000000075516000-memory.dmp

Download

memory/1708-1-0x00000000754F0000-0x0000000075516000-memory.dmp

Download

memory/1708-2-0x00000000754F0000-0x0000000075516000-memory.dmp

Download