054b681f953cca64eea0afc1aca0f63735a6bb03df7786c1ec59eb24fa9ceb2c

Analysis

max time kernel
143s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 01:40

Target

231b42ae39627fea2de631b3909974f3.dll
Size

166KB
MD5

231b42ae39627fea2de631b3909974f3
SHA1

01bf3d845d0141be8482c7748ffe5b7eb58292dd
SHA256

054b681f953cca64eea0afc1aca0f63735a6bb03df7786c1ec59eb24fa9ceb2c
SHA512

466a30c0a4122be12444afcb867d4b70cd796bb3b127d55ea676db2d57293b9e4437567d42d43060ef2a049725c702b0eb0d0ebbaf054ac698aa68c4e95d52fa
SSDEEP

3072:3+opLz0mNlXJ35SxUFlzcbTb1aiTdMJfLGZQ84sypytlJtiAVz6WlT3AJo:3bpz0mnJ38xgzAU7JyZQ84YDttVzdlc

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1960-0-0x0000000010000000-0x000000001007F000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1960	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3860 wrote to memory of 1960	3860	rundll32.exe	90
PID 3860 wrote to memory of 1960	3860	rundll32.exe	90
PID 3860 wrote to memory of 1960	3860	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\231b42ae39627fea2de631b3909974f3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\231b42ae39627fea2de631b3909974f3.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1960

memory/1960-0-0x0000000010000000-0x000000001007F000-memory.dmp

Filesize
508KB

Download