e577ced6435462c351153cc883c8901d3c0d29575361b8ecf11e5f28fcdf644e

Analysis

max time kernel
147s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 12:18

Target

1844e7fcab1c34e34038f9a857b95a60.dll
Size

10KB
MD5

1844e7fcab1c34e34038f9a857b95a60
SHA1

547c2671676c4881e7c86e72934fe808ae0035e6
SHA256

e577ced6435462c351153cc883c8901d3c0d29575361b8ecf11e5f28fcdf644e
SHA512

0016624a112a88926a040be57730f007c3a8e9b200a30aa3983b5bda6e42e9c7afd82e92cff88c6dd42f658cc716152cc905ec200857feae3b5ff20108e62d4e
SSDEEP

192:nrBgb2AeKi5m59NER2VSgxeEqrx2D22DUDXWRcnN1NNNkswib:NbIiKZ0g/qd2D2HWRcXfNP

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/452-0-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/452-1-0x0000000000400000-0x000000000040D000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
452	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 452	4492	rundll32.exe	74
PID 4492 wrote to memory of 452	4492	rundll32.exe	74
PID 4492 wrote to memory of 452	4492	rundll32.exe	74

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1844e7fcab1c34e34038f9a857b95a60.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1844e7fcab1c34e34038f9a857b95a60.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:452

memory/452-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/452-1-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download