16b2acfed919c5cf3dcfc898219769505ea9c3dfb3823b6c44ca5eb8b406cdba

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 09:09

Target

13fc37c068683cdd9aee94b4b9085911.dll
Size

61KB
MD5

13fc37c068683cdd9aee94b4b9085911
SHA1

ca68ca958d61cff613ec17eb54f909b7b530246f
SHA256

16b2acfed919c5cf3dcfc898219769505ea9c3dfb3823b6c44ca5eb8b406cdba
SHA512

fb2b375b241605feb748891f0f7c18553cf620c7ab391c9ea22e61bd9c72bd1349f2b2860dc460195cb02821964379ccc5b3fb68ab2d7071453d00c476754dcf
SSDEEP

1536:V8O9Nn6RjriwVyW6iJjw6aJxqYWuTBs5NzcEGnfdLvq927P3:2Oz6VWQ0kcRgwfBnr3

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1268-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1268	1092	rundll32.exe	89
PID 1092 wrote to memory of 1268	1092	rundll32.exe	89
PID 1092 wrote to memory of 1268	1092	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\13fc37c068683cdd9aee94b4b9085911.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\13fc37c068683cdd9aee94b4b9085911.dll,#1
  2⤵
  PID:1268

memory/1268-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download