e46fabbd1fdc9b2b936db2792c47b587463b8367e08065bd110dd65cb9773575

Analysis

max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 09:53

Target

50403eced9fb3e924b20cc59cebd63f5.dll
Size

103KB
MD5

50403eced9fb3e924b20cc59cebd63f5
SHA1

45f75366648356822ac26cbb63b589c005124f62
SHA256

e46fabbd1fdc9b2b936db2792c47b587463b8367e08065bd110dd65cb9773575
SHA512

14121a7c8edbfe8d4e2bcbe212b7c9d2155fdf10287d3107d34a71bea8be5729437907fc09284c20c17220aeb750131bacf8ab4ad85809d2d980c5a06007a8f1
SSDEEP

1536:Nh1fL15Vx2G5bCgsSeA1tUffb2yz01pdvxdkho/8DrIya5pcNqKbq:Nh53p5NIyjy45VkDHa8qKbq

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2216-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 976 wrote to memory of 2216	976	rundll32.exe	54
PID 976 wrote to memory of 2216	976	rundll32.exe	54
PID 976 wrote to memory of 2216	976	rundll32.exe	54

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\50403eced9fb3e924b20cc59cebd63f5.dll,#1
1⤵
PID:2216

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\50403eced9fb3e924b20cc59cebd63f5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:976

memory/2216-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download