39f24f46064581e3a85e35b97039da86a6394daf0b5509a663f85c2cbbdee7eb

Analysis

max time kernel
132s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2023, 21:28

Target

f956bf709df7861faebc404c5c19daad.dll
Size

71KB
MD5

f956bf709df7861faebc404c5c19daad
SHA1

19bb6127ac3a4093be8ec6c40e7a7b7750c6374a
SHA256

39f24f46064581e3a85e35b97039da86a6394daf0b5509a663f85c2cbbdee7eb
SHA512

d83f5e112f034a1db615bc20ed88747257a465a026b7ae514951a21539a12a23e25d4fb8139e601c5cad9a98ed760a2b855eeb25eb1fc25ad16f28485d25f650
SSDEEP

1536:Bm1NGJVGdEC0qcsj9Yili+xAS7s5RDKHiXPcfhqd:kX0V20qcsRtli+mS7sLDKHi/cg

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4424-0-0x0000000010000000-0x0000000010013000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 4424	4688	rundll32.exe	88
PID 4688 wrote to memory of 4424	4688	rundll32.exe	88
PID 4688 wrote to memory of 4424	4688	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f956bf709df7861faebc404c5c19daad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f956bf709df7861faebc404c5c19daad.dll,#1
  2⤵
  PID:4424

memory/4424-0-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download