b2daa446ad1b606843bff4bac27d1a69fd4c164ba0c23f2b62e184a21d7ea43e

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 13:14

Target

3787339ebdff657bcd67f452f3b886f0.dll
Size

99KB
MD5

3787339ebdff657bcd67f452f3b886f0
SHA1

17162005ea07c949709330400b74260ac8830153
SHA256

b2daa446ad1b606843bff4bac27d1a69fd4c164ba0c23f2b62e184a21d7ea43e
SHA512

3d2c04f9832fe850fa05ec13be596d0c9ea64b3cc1fafb4428c000597812fac9be6b5848f3ab78e7d6050785749c19ac6f3cbf6dd3d5929701c8081897d1bd72
SSDEEP

1536:5YMXz87wxBlbA4nazhdExD32+6f4OCFYdAcOohKbz0TrIKC+IBc5HgUfOeeb:5pM4nazhd06fJOpUKbwTzRW+HgcOe

Score

7^/10

upx

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1352-1-0x0000000010000000-0x0000000010042000-memory.dmp	upx
behavioral2/memory/1352-0-0x0000000010000000-0x0000000010042000-memory.dmp	upx
behavioral2/memory/1352-2-0x0000000010000000-0x0000000010042000-memory.dmp	upx
behavioral2/memory/1352-5-0x0000000010000000-0x0000000010042000-memory.dmp	upx
behavioral2/memory/1352-4-0x0000000010000000-0x0000000010042000-memory.dmp	upx
behavioral2/memory/1352-6-0x0000000010000000-0x0000000010042000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 1352	1400	rundll32.exe	26
PID 1400 wrote to memory of 1352	1400	rundll32.exe	26
PID 1400 wrote to memory of 1352	1400	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3787339ebdff657bcd67f452f3b886f0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3787339ebdff657bcd67f452f3b886f0.dll,#1
  2⤵
  PID:1352

memory/1352-1-0x0000000010000000-0x0000000010042000-memory.dmp

Filesize
264KB

Download
memory/1352-0-0x0000000010000000-0x0000000010042000-memory.dmp

Filesize
264KB

Download
memory/1352-2-0x0000000010000000-0x0000000010042000-memory.dmp

Filesize
264KB

Download
memory/1352-3-0x0000000001400000-0x0000000001417000-memory.dmp

Filesize
92KB

Download
memory/1352-5-0x0000000010000000-0x0000000010042000-memory.dmp

Filesize
264KB

Download
memory/1352-4-0x0000000010000000-0x0000000010042000-memory.dmp

Filesize
264KB

Download
memory/1352-6-0x0000000010000000-0x0000000010042000-memory.dmp

Filesize
264KB

Download