7c8b66dee56411f6a98346db85236608b29c84540e2afab756bf31720c1b373c

Analysis

max time kernel
151s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 14:17

Target

24d30c7e6d128abd8745c2736c3aabe1.dll
Size

69KB
MD5

24d30c7e6d128abd8745c2736c3aabe1
SHA1

ab1306fdc10a1759cc275c404249c3df5b13eb2a
SHA256

7c8b66dee56411f6a98346db85236608b29c84540e2afab756bf31720c1b373c
SHA512

170adc53adcbcf32aebc62ef06d3280f91d84996f77ffd0b9881987246ec88299a94a3bb4125a738f8ec97a74cc642aeeb451d0aae4e52985885f7e0679b8a63
SSDEEP

1536:LszMRUysbq1Atz0/nGKZEEfyPKuCYiiSVdFoPheBFYgCPZ:L6Pvq1T/nGnIyPKuCViSVdFHBzU

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/224-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 224	412	rundll32.exe	20
PID 412 wrote to memory of 224	412	rundll32.exe	20
PID 412 wrote to memory of 224	412	rundll32.exe	20

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24d30c7e6d128abd8745c2736c3aabe1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\24d30c7e6d128abd8745c2736c3aabe1.dll,#1
  2⤵
  PID:224

memory/224-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download