946e0460f9fe02665bf5c6f57335636bffb9f8662e50f211540bbfeda62b8037

Analysis

max time kernel
143s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 23:59

Target

3b65853511c2b8e89721b492923dc093.dll
Size

40KB
MD5

3b65853511c2b8e89721b492923dc093
SHA1

69420302711f835631e96630ba03814294f9d984
SHA256

946e0460f9fe02665bf5c6f57335636bffb9f8662e50f211540bbfeda62b8037
SHA512

e659fe0042f53efc2de51df3d663fda82bcf14caa0066dc9ef3584e5d41ad30bccff55d84b02b07058d7c6d3c1bb8feabeae7fbeabe90ad76b118e6850313d73
SSDEEP

768:d9oLxylheojmGha4R3b9baX463QJjbfKSzdTHiLJWuvnbcuyD7US:TfE4NsXNQZCAdTHiLJRnouy8S

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/376-0-0x0000000010000000-0x0000000010026000-memory.dmp	upx
behavioral2/memory/376-1-0x0000000010000000-0x0000000010026000-memory.dmp	upx
behavioral2/memory/376-6-0x0000000010000000-0x0000000010026000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 376	4224	rundll32.exe	16
PID 4224 wrote to memory of 376	4224	rundll32.exe	16
PID 4224 wrote to memory of 376	4224	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b65853511c2b8e89721b492923dc093.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b65853511c2b8e89721b492923dc093.dll,#1
  2⤵
  PID:376

memory/376-0-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download
memory/376-1-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download
memory/376-6-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download