13d1239ee56cab31a70c9bee78d28172df9059bee4159345822e92dab10795f0

Analysis

max time kernel
187s
max time network
213s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 17:51

Target

32495a12089cfdfea4bba7178bcc4953.dll
Size

59KB
MD5

32495a12089cfdfea4bba7178bcc4953
SHA1

8db253e465957fef94bf8fc13f0bb6eea2773ef0
SHA256

13d1239ee56cab31a70c9bee78d28172df9059bee4159345822e92dab10795f0
SHA512

74500d9e438a34cba56fa66367294856e05c52a006c16f30968ec35d2a10013c11d5ea0568e76e1302d321f6a047601c053b12959c24eb96453fb8fee1533961
SSDEEP

768:yuUr3ip/IHI7NQTvQ4S+7gOlhMValYcppcx6OoIxOLc+p/MEmBn2yVR/OQ4Vp2CS:yl3E0T3N19po6st+pxmtV0vT5n34

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3392-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 3392	2960	rundll32.exe	88
PID 2960 wrote to memory of 3392	2960	rundll32.exe	88
PID 2960 wrote to memory of 3392	2960	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\32495a12089cfdfea4bba7178bcc4953.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\32495a12089cfdfea4bba7178bcc4953.dll,#1
  2⤵
  PID:3392

memory/3392-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download