69a8791a056ce61cd5f2d4662fd334e0387c36b3de7b84ec3213b9074141a9db

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 03:05

Target

25b318dc9cd5f863656bb2f8dbac5a30.dll
Size

19KB
MD5

25b318dc9cd5f863656bb2f8dbac5a30
SHA1

f005f03bea96a89b99f4a40eb760bdb7fd5ca01e
SHA256

69a8791a056ce61cd5f2d4662fd334e0387c36b3de7b84ec3213b9074141a9db
SHA512

cc8c8980995e0653504482ab4841cc75a20c482d62a4b9ab5841aaccb95285a65b2f727adab70f37ae15141433e9cf4fe813864b1d1fe6dbe8715a923ab3d1b2
SSDEEP

384:VFN7a1q5mBq/txZoI6rIA6gPnJIeoDaOpDaja/dD0LzYQR:VFI1q5q0xZo1rIA6g/boL5map0UQ

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1012-0-0x0000000010000000-0x000000001001E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 1012	2400	rundll32.exe	73
PID 2400 wrote to memory of 1012	2400	rundll32.exe	73
PID 2400 wrote to memory of 1012	2400	rundll32.exe	73

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\25b318dc9cd5f863656bb2f8dbac5a30.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\25b318dc9cd5f863656bb2f8dbac5a30.dll,#1
  2⤵
  PID:1012

memory/1012-0-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download