75e6378fb7505de58ac7011070b84481c80abf69bdf7be94f2b2e68a6086d210

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 23:41

Target

51f184ac3f6d5457e285ebce03d375b9.dll
Size

12KB
MD5

51f184ac3f6d5457e285ebce03d375b9
SHA1

0b80425583ddba404818c3943c889cacb1be26ef
SHA256

75e6378fb7505de58ac7011070b84481c80abf69bdf7be94f2b2e68a6086d210
SHA512

54f0c9bde181955f78d12207321fee7672c01668b4f548c3ba9044fdb3320b108d7ec0fcf0d22ad6c11496aa7bed47a78bdad20b08a1e1ec7de2dd3d6e970435
SSDEEP

192:kvQqQLVXh8gaFLKlcMsDBe4dGTLlPG4pdAaTXdjjBxXp4eh6JhU89zvE4:kvaVmzFLNDDBe9TLlb7Xdjjrns+8tv

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1116-0-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 1116	2884	rundll32.exe	18
PID 2884 wrote to memory of 1116	2884	rundll32.exe	18
PID 2884 wrote to memory of 1116	2884	rundll32.exe	18

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\51f184ac3f6d5457e285ebce03d375b9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\51f184ac3f6d5457e285ebce03d375b9.dll,#1
  2⤵
  PID:1116

memory/1116-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download