a07062cb5e0bc9f8f7250ba9f1b1e81641c96b74659af89da2da28b983a8cef4

Analysis

max time kernel
92s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 20:07

Target

XMTS20090628/程序功能/CHJ005.dll
Size

11KB
MD5

cf96cf41747c1370932645c91ae91497
SHA1

c702aea5e2f23269c2d2796c00a8c4df22e762d2
SHA256

94e656ce870fce361a2dda9689cbaf2a060797fb15a594100c690386caa0f9cb
SHA512

b27d4955513df1dc224edb10297de1516e2a59cac1e42936cdcaa4b0a2313ad4611e11340cc57a54dc6262c8ee9956b2c1e41f3fb3ff660dc7a78bba97f972fa
SSDEEP

192:nflThrhKMYrnuu5H2UE8x2AMAPiOYVgpYPmxn4Hhrw84xKbVvbaA:/rhIruu5HkgfMvVYYPmxwh4KJDa

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral18/memory/4788-0-0x0000000000400000-0x000000000040D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 4788	3988	rundll32.exe	17
PID 3988 wrote to memory of 4788	3988	rundll32.exe	17
PID 3988 wrote to memory of 4788	3988	rundll32.exe	17

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XMTS20090628\程序功能\CHJ005.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\XMTS20090628\程序功能\CHJ005.dll,#1
  2⤵
  PID:4788

memory/4788-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download