fe0b67de27326bf2a7550481429bca77a71c6490d6812def613f5613a73f39d3

Analysis

max time kernel
145s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 05:36

Target

2a41963ada86700a5fe3ab4ab153606b.dll
Size

70KB
MD5

2a41963ada86700a5fe3ab4ab153606b
SHA1

d2e2699b2e99b2c1eacc58717e2f3bb03334a383
SHA256

fe0b67de27326bf2a7550481429bca77a71c6490d6812def613f5613a73f39d3
SHA512

48ed58ee6c18e92f128ede847b51385497aa228052a8d9bd07940b925993258ddc3f3328e8750bc0a65281eca1d46395a6cb02b7c774269711cdd012c24a6168
SSDEEP

1536:23umoMtxM4fuwokYE1ZgG5ojUNCVqeKlnT11Ku0CDtrklQu0EP/dcugk:CoMtxM4f9/N3gTAN8v4vb0CDoQlIcbk

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3108-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 3108	4052	rundll32.exe	16
PID 4052 wrote to memory of 3108	4052	rundll32.exe	16
PID 4052 wrote to memory of 3108	4052	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a41963ada86700a5fe3ab4ab153606b.dll,#1
1⤵
PID:3108

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a41963ada86700a5fe3ab4ab153606b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4052

memory/3108-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download