3a59471f049bba4abc1604e98c555bcb8ca53ea8f2ef4ab2a60395a2f73b3512

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15/01/2024, 05:38

Target

5c45f6e80dfd196bc9d90e3ace6ee30f.dll
Size

57KB
MD5

5c45f6e80dfd196bc9d90e3ace6ee30f
SHA1

583439c7c9806d106f15ca7485e34f5ec591b4be
SHA256

3a59471f049bba4abc1604e98c555bcb8ca53ea8f2ef4ab2a60395a2f73b3512
SHA512

d836d61cc7555b76453f98cf5d4be7a4638f120f35c075a255a975a9722bb865b694f0b0a0606af010ae4985d64ef66337408c8046937a04f220fc41074ff7e1
SSDEEP

1536:V8O9Nn6RjricHWFb3/+69x+Nvx3WvaY/umHHm7nq1dU5yD43:2Oz6VWcHIbP+69x+N5SNG7qLsu43

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3024-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3272 wrote to memory of 3024	3272	rundll32.exe	21
PID 3272 wrote to memory of 3024	3272	rundll32.exe	21
PID 3272 wrote to memory of 3024	3272	rundll32.exe	21

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c45f6e80dfd196bc9d90e3ace6ee30f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c45f6e80dfd196bc9d90e3ace6ee30f.dll,#1
  2⤵
  PID:3024

memory/3024-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download