477556ab9ff3de11c0b6ca3e4b59964d5fb34758c2d88b7395ca9cda87cae8c7

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 13:47

Target

1a7fe93a70421aa638a195959f4030fc.dll
Size

247KB
MD5

1a7fe93a70421aa638a195959f4030fc
SHA1

c4e10c53b7b5ce9261cfa26268d7acd6d8f4d4ea
SHA256

477556ab9ff3de11c0b6ca3e4b59964d5fb34758c2d88b7395ca9cda87cae8c7
SHA512

4bee8debf24721bb45e966b1461453c381b7b7a11206740368c8556dfcfa2453773440563ed5adb28658db9e7e409ac1c62666c05cefc5403785519108632b69
SSDEEP

6144:CqWjrZJlKmH2a+E2eLigiYKA8dfNTdVLbmrOpK8O7xIL:CqGrZJlKmH9+Uigi/ASN5lbmrO1O7xIL

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4724-3-0x0000000010000000-0x00000000100A4000-memory.dmp	upx
behavioral2/memory/4724-1-0x0000000010000000-0x00000000100A4000-memory.dmp	upx
behavioral2/memory/4724-5-0x0000000010000000-0x00000000100A4000-memory.dmp	upx
behavioral2/memory/4724-4-0x0000000010000000-0x00000000100A4000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4724	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 4724	624	rundll32.exe	89
PID 624 wrote to memory of 4724	624	rundll32.exe	89
PID 624 wrote to memory of 4724	624	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a7fe93a70421aa638a195959f4030fc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a7fe93a70421aa638a195959f4030fc.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4724

memory/4724-0-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download
memory/4724-3-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download
memory/4724-2-0x0000000001F10000-0x0000000001F4C000-memory.dmp

Filesize
240KB

Download
memory/4724-1-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download
memory/4724-5-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download
memory/4724-4-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download