6f51460843031beffe8e712e1024391e52e2aa872c809f48a104b91fba836de4

Analysis

max time kernel
138s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 08:57

Target

64fedc5e818897338cc16ed8425eac5a.dll
Size

52KB
MD5

64fedc5e818897338cc16ed8425eac5a
SHA1

aa833e9a95d43a1f66b4f8ff2e0a9806ff001d4b
SHA256

6f51460843031beffe8e712e1024391e52e2aa872c809f48a104b91fba836de4
SHA512

d86e6ade677e54342e14e5a6e31bc8272244a62831d872271a5ad3e4f74fa6ad1edcd00e5bde0eeb0334b56dee847b96049f78b072709c605aa3a3b06a11ef96
SSDEEP

768:GbvLDaaMact8T1DNvNyUr07tppOz7XBozujvSRsL7caMd2ZwDIyH8DEPjQ6WBQ4+:evBJ907bpOHX3aRsLJMywDIyHSIQ6yQX

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/556-0-0x0000000010000000-0x000000001000C000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 556	2480	rundll32.exe	87
PID 2480 wrote to memory of 556	2480	rundll32.exe	87
PID 2480 wrote to memory of 556	2480	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\64fedc5e818897338cc16ed8425eac5a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\64fedc5e818897338cc16ed8425eac5a.dll,#1
  2⤵
  PID:556

memory/556-0-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download