8779fde0e874cf3f56c664e656d4a2278cb5473ad10cff15848559aa97067620

Analysis

max time kernel
135s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 02:37

Target

24bea92ad7aab665e4a0a3d2d900bf4d.dll
Size

44KB
MD5

24bea92ad7aab665e4a0a3d2d900bf4d
SHA1

4f9292a44aae2868a83bbde5a3762b206a5db810
SHA256

8779fde0e874cf3f56c664e656d4a2278cb5473ad10cff15848559aa97067620
SHA512

111b505cdfbcc5bbee6002e3dd30c6ffc80fc545ea1cfe09fcf596cfb7336a738ba97f7178d9f10cb80d3f5b51a8aa52e4996a3ea411f1e367e3ed33e2de7a31
SSDEEP

768:yuUr3ip/IHI7NQTvTBNz6JgDSjQ+zxob06uy7P6bT10VaOUr7l/wvAuNYOi3+j:yl3E0Trf2ASjQ+i06L7miVadwICuuj

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2716-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 2716	4600	rundll32.exe	89
PID 4600 wrote to memory of 2716	4600	rundll32.exe	89
PID 4600 wrote to memory of 2716	4600	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24bea92ad7aab665e4a0a3d2d900bf4d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\24bea92ad7aab665e4a0a3d2d900bf4d.dll,#1
  2⤵
  PID:2716

memory/2716-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download