37cac7631f21aa78a72da3a4a8577b2e103fd02ddaf02f7731e35b383b66e0fc

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 17:17

Target

4173cf33be91ade641a07bec60147eec.dll
Size

52KB
MD5

4173cf33be91ade641a07bec60147eec
SHA1

168137d64a4d038abfcbcb9a717126fbd298605c
SHA256

37cac7631f21aa78a72da3a4a8577b2e103fd02ddaf02f7731e35b383b66e0fc
SHA512

40072072584e0b66a31a7e489620122453bb2162fbbf50f0b458ada308d17bce4fe6b090bf19a6df3bc0181c3b9f38e26fe56ca2c53cd100bcac2b08c7f3b922
SSDEEP

768:z3OHS8KOz/or/3ZfsCQU0iGMcLTEPn3ajMPeXuEyA1AUL49G7eCJu1f/k/hRAAL6:yHZmR6iGMQTEPzPyByajzoyPAYitR

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4784-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 4784	4904	rundll32.exe	72
PID 4904 wrote to memory of 4784	4904	rundll32.exe	72
PID 4904 wrote to memory of 4784	4904	rundll32.exe	72

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4173cf33be91ade641a07bec60147eec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4173cf33be91ade641a07bec60147eec.dll,#1
  2⤵
  PID:4784

memory/4784-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download