5f64f90b82843b2e5e9a26121587c5a67c52bd206f918cea964686ae368aaaa6

Analysis

max time kernel
166s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 22:25

Target

1e677c5edfd4d68d1c435f648688a454.dll
Size

16KB
MD5

1e677c5edfd4d68d1c435f648688a454
SHA1

0102e59f19873d1db949c4a18f1473eeb986f7df
SHA256

5f64f90b82843b2e5e9a26121587c5a67c52bd206f918cea964686ae368aaaa6
SHA512

a294a77fa551976510678437b559a208ae914e0af65151af429eb30bdaa9e16c80ab7add6e7743f833466d4071e9f45646ce6e532e08ec4f3978325a27b5b34d
SSDEEP

384:RvbGU4kzT2J7n/pT5l3b35ohvei/6+dQaIy0ao30wIX4:FbGU4kzi3P3mhvei/VdIy0DH

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1764-0-0x0000000000400000-0x0000000000413000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1764	1652	rundll32.exe	88
PID 1652 wrote to memory of 1764	1652	rundll32.exe	88
PID 1652 wrote to memory of 1764	1652	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e677c5edfd4d68d1c435f648688a454.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e677c5edfd4d68d1c435f648688a454.dll,#1
  2⤵
  PID:1764

memory/1764-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download