58ab7a0e6c1fb9e1c95feea697964d9379460fe96685e831afece0eb1628ef98

Analysis

max time kernel
142s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2024 02:38

Target

524f34635960ba1c30c5921adeef2955.dll
Size

79KB
MD5

524f34635960ba1c30c5921adeef2955
SHA1

74566f569c24aae7554302abd9b5049b28a12a6a
SHA256

58ab7a0e6c1fb9e1c95feea697964d9379460fe96685e831afece0eb1628ef98
SHA512

0663c5be52926af2b4790ebb2ac38e6812b154c8084e73de641dd9a75750808a65122413f6e8d6a7abed0c0309f9f5f3695ba05ec855f9e848ba7ae84fb9f4e7
SSDEEP

1536:UoBp6FSoU5y1BPMr0o5uJNMxc/tsmX+2CwVSBROpZR1zHhWT2sgv5vpXAalxrZJ5:rBySoUQ1Bkr0o5uJN+Qs1B6tHhq2sgvP

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2792-0-0x0000000000400000-0x000000000043E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 2792	4088	rundll32.exe	91
PID 4088 wrote to memory of 2792	4088	rundll32.exe	91
PID 4088 wrote to memory of 2792	4088	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\524f34635960ba1c30c5921adeef2955.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\524f34635960ba1c30c5921adeef2955.dll,#1
  2⤵
  PID:2792

memory/2792-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download