c252ad96610d51dad699a9a44fda923cfed4757a9e5af5d119777d75cc894e78

Analysis

max time kernel
147s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 03:30

Target

267447766cd694696b4e82232a944a3d.dll
Size

12KB
MD5

267447766cd694696b4e82232a944a3d
SHA1

11b206de332705b47366f60e7eb26f20c15d4aa3
SHA256

c252ad96610d51dad699a9a44fda923cfed4757a9e5af5d119777d75cc894e78
SHA512

ff9d6839c5579739e72b05cc8ca5ece12c78bf97408117fdb7895b9535fdc5d96e6519e992e2c0a32723c7f22c5f91b24af2fe092a9da89d29ea5db1c1f7bc3f
SSDEEP

192:nroiGqRk3a+vNlPss9xrpntWi0kk6AfwUqgqItepoQ8Y2OuiYiHkraukv:spqRk3fvPvxrptW8UFq+L2kraT

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3712-0-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3712	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 3712	3676	rundll32.exe	14
PID 3676 wrote to memory of 3712	3676	rundll32.exe	14
PID 3676 wrote to memory of 3712	3676	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\267447766cd694696b4e82232a944a3d.dll,#1
1⤵
- Suspicious use of SetWindowsHookEx
PID:3712

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\267447766cd694696b4e82232a944a3d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3676

memory/3712-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download