424fa341c43103e360081ec33837f4a31b0d1f3d7b54721840df1baf20b35df0

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 02:54

Target

255033b3427515bdba4c42080c12232d.dll
Size

74KB
MD5

255033b3427515bdba4c42080c12232d
SHA1

735ddcce11d3aa219989063c6397415f35110b56
SHA256

424fa341c43103e360081ec33837f4a31b0d1f3d7b54721840df1baf20b35df0
SHA512

7a093ebada5fc56945c832825f9afe44438ff18e7a2adfc191cff248ddb682585e1103d87523a2aca848ee1d293b52771e1220524315f4f753cd71f8d70b757d
SSDEEP

1536:jV9l/C0KG8NDuifGwCZFBMrF2AdrcVnqf1pKiODx:Bq0K79uifGT1MR2Adrynqf1e

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3196-0-0x0000000010000000-0x000000001000C000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 3196	2612	rundll32.exe	16
PID 2612 wrote to memory of 3196	2612	rundll32.exe	16
PID 2612 wrote to memory of 3196	2612	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\255033b3427515bdba4c42080c12232d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\255033b3427515bdba4c42080c12232d.dll,#1
  2⤵
  PID:3196

memory/3196-0-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download