f01d802f545361fb89e9075065bb11d8ec0f4ebd667a7cf2442ce47f7cefaf55

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 11:30

Target

1ae8526a14fe5ac638440aac8e3fdedb.dll
Size

63KB
MD5

1ae8526a14fe5ac638440aac8e3fdedb
SHA1

94419701f3b123e09ec6c8577ffe8c36e7406335
SHA256

f01d802f545361fb89e9075065bb11d8ec0f4ebd667a7cf2442ce47f7cefaf55
SHA512

4c5186ff6d9b6b82d6efb74ca696595335379f55dcc88b4105d61ba9435a9c326c9dc168bf2b76988d67bafd6b6778a1edaa93827f2868a14eef810799e5df67
SSDEEP

768:GWCAnFdvBNmnFfKS+3Bnes1T3X3oIqCHcXWjKKI8moY:GWCqPNmnZKT8s53oIJNKKI81Y

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2120-0-0x0000000010000000-0x0000000010011000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 2120	1852	rundll32.exe	11
PID 1852 wrote to memory of 2120	1852	rundll32.exe	11
PID 1852 wrote to memory of 2120	1852	rundll32.exe	11

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ae8526a14fe5ac638440aac8e3fdedb.dll,#1
1⤵
PID:2120

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ae8526a14fe5ac638440aac8e3fdedb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1852

memory/2120-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download