e86c368c2083ca167dcabf1f23783cae78bc191bea30189f63b7e7d98f4b90b0

Analysis

max time kernel
143s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 13:48

Target

7358b72660e3c980a6f946f580f36196.dll
Size

30KB
MD5

7358b72660e3c980a6f946f580f36196
SHA1

cfdbc495c24a5c4cdf5d0d73fc0fe0abd6e30dc6
SHA256

e86c368c2083ca167dcabf1f23783cae78bc191bea30189f63b7e7d98f4b90b0
SHA512

14a51ab7a317182ab28a5c8fde2d49116d44310934fceeec81f7d731dcd3be4121009258d7d73e59469600de9d8bbb5046a5535e3175f010f7941e172c8b4cca
SSDEEP

384:w8ibGt1IqH9IgoxkS7ZKEU0vxy49R5rVOo45rOcFwrrnMSXUQvFM88cMCKim9C:N3ztIgoZ0EUd49R5JOokOcF0rMSZvsQ

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4212-0-0x0000000000400000-0x0000000000418000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 4212	1844	rundll32.exe	16
PID 1844 wrote to memory of 4212	1844	rundll32.exe	16
PID 1844 wrote to memory of 4212	1844	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7358b72660e3c980a6f946f580f36196.dll,#1
1⤵
PID:4212

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7358b72660e3c980a6f946f580f36196.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1844

memory/4212-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download