e3b27197107f96e378e6a4c8f33a1f13f4dd08ee2da60e8b5c423a2712762209

Analysis

max time kernel
139s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2023, 21:40

Target

plugins/CRC32.dll
Size

15KB
MD5

e20ad1f3a9f26dc92125fe4db656a0f2
SHA1

9b3ece0e9b76df47322e3071a725f6ecbc1d3771
SHA256

24dad0d27ff3acca09dcbecc96b248fe2edf36404b3a48ba8e5dc883bc07b023
SHA512

b6495edcbdb22b8e8d63d62148f26a24ff29a70437ef0b88d93916e6dcca8864eebdbe5dd8d8467ac21ea1317332cf7da8f4eaaf0611ad21c46b0edc3cea4c16
SSDEEP

192:8XaVgsu4LEGFQqBiD5CXw/JKYzUZe72HAH+sXnlnK7AVXmc/eurb7TGkpIhASu4a:8XaVhRVFsD5CXwkmRVZVJRPQAsmS

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral10/memory/3004-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx
behavioral10/memory/3004-1-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 3004	5032	rundll32.exe	89
PID 5032 wrote to memory of 3004	5032	rundll32.exe	89
PID 5032 wrote to memory of 3004	5032	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\CRC32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\CRC32.dll,#1
  2⤵
  PID:3004

memory/3004-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/3004-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download