a2bc5372658351f1f8442a9820c2f29a3cbaa1e19df6adc8ad6861932266ffb7

Analysis

max time kernel
138s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 03:06

Target

foredu.com demo software/xSpeed.net/hardsp.dll
Size

17KB
MD5

c126b71fa9426570103a5bedb656ddad
SHA1

856ec39f9403e074d9cd220dfc8dde8742331553
SHA256

89894a149926c28a567ad56450f37698ff024fbc3e5dbc3e636b5929559c1c97
SHA512

23e213291298b35f26204e456cabb569a75c25928ecb69b645c4cf0fe6a74836c9a8a9edfb3334554e8686b42e616ca669b6a0c3c4bb36109402c4aaf5045403
SSDEEP

384:6uns2Xt8nL5SIwtxn/odt0iGCZ/2FBlAmhBDQUasXnh:6uns2XatcoHbZ/2FBlAkJisX

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral4/memory/4660-0-0x0000000010000000-0x0000000010011000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\winio.sys	rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
668	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 4660	2304	rundll32.exe	89
PID 2304 wrote to memory of 4660	2304	rundll32.exe	89
PID 2304 wrote to memory of 4660	2304	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\foredu.com demo software\xSpeed.net\hardsp.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\foredu.com demo software\xSpeed.net\hardsp.dll",#1
  2⤵
  - Drops file in System32 directory
  PID:4660

memory/4660-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download