a5b4fba0c422588c24752c802d5c8479ff32a690db8c75950da1dd1994535f44

Analysis

max time kernel
163s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 08:40

Target

607fcd112c65ad1ba2b9c9b46a801245.dll
Size

110KB
MD5

607fcd112c65ad1ba2b9c9b46a801245
SHA1

621fafc264ed025f79c1b62a1280bf34f3ec993d
SHA256

a5b4fba0c422588c24752c802d5c8479ff32a690db8c75950da1dd1994535f44
SHA512

1a6d4a6ed3aedf30ca2462726489750caffba93ad63ba358181dc9fb2310f3182672f2533180ec4742ea775f51e91476819275757c4810dbb63ec843d13b6876
SSDEEP

768:riuGKppWZ5OK3abfc9YtDACQestrJopT7adaKe2CSs9TrJT60Gzcydwoj2OwL1E2:riu352CSs5pydwoj23mxVtJGu9/iGiD

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4424-0-0x0000000062C20000-0x0000000062C3D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 4424	4552	rundll32.exe	16
PID 4552 wrote to memory of 4424	4552	rundll32.exe	16
PID 4552 wrote to memory of 4424	4552	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\607fcd112c65ad1ba2b9c9b46a801245.dll,#1
1⤵
PID:4424

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\607fcd112c65ad1ba2b9c9b46a801245.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4552

memory/4424-0-0x0000000062C20000-0x0000000062C3D000-memory.dmp

Filesize
116KB

Download