c4e57cf797ba45c30f8a6121eec8e0c5331d1a077fb19e1f629969254c60fba1

Analysis

max time kernel
157s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 04:15

Target

0e1a764f9f6384f51d3fb76c96f350aa.dll
Size

19KB
MD5

0e1a764f9f6384f51d3fb76c96f350aa
SHA1

fc164943d730cc9dea98b84b58f2ea1da588c578
SHA256

c4e57cf797ba45c30f8a6121eec8e0c5331d1a077fb19e1f629969254c60fba1
SHA512

8e49f7a307039c80bfcb2a19d9f139e4de1f775f0251db838a8ba5e6e911a8207cacc0634c0a760d66fb4309a3da263f32cc76588213e038a38bc5042671e02b
SSDEEP

384:UPK35DE3puiIXPiNItvVMuAzNswH1QrxnPpdMan6+xtTwCFTYROXPif:X5QZuvXPi1uKGg1Q94an6Pe6f

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2312-0-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2312-1-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACADABAF-1000-0010-8000-10AA006D2EA4}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACADABAF-1000-0010-8000-10AA006D2EA4}\InProcServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACADABAF-1000-0010-8000-10AA006D2EA4}\InProcServer32\ = "C:\\Windows\\system32\\system.dat"	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 2312	4232	rundll32.exe	89
PID 4232 wrote to memory of 2312	4232	rundll32.exe	89
PID 4232 wrote to memory of 2312	4232	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e1a764f9f6384f51d3fb76c96f350aa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e1a764f9f6384f51d3fb76c96f350aa.dll,#1
  2⤵
  - Modifies registry class
  PID:2312

memory/2312-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2312-1-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download