a07062cb5e0bc9f8f7250ba9f1b1e81641c96b74659af89da2da28b983a8cef4

Analysis

max time kernel
88s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 20:07

Target

XMTS20090628/程序功能/CHJ006.dll
Size

187KB
MD5

c21b9949e8bd3499c2188ae43cce1ad7
SHA1

3108e38fd6988d96a45d49dfa1c8ecac2478cf01
SHA256

2b952802c039114d51ba67078acb37e8d4ee4e91afc26602aad2db93c5ac23a7
SHA512

3cd26aeed0adedb609532a49ee3e0f22a9dc6e1bc9c08f127356801634d754605292e4bc0bf3dfa87a86c24df714f9057f39a999eda70ee283183e5905663374
SSDEEP

3072:7OZ88571r5o7PUsWp59wFsgvPDfRRoFjRo5hBcep8adjRPmt1CA:7Orjr5qPUjFwFBvPNRoVR+cadjRPm

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral20/memory/444-0-0x0000000002250000-0x00000000022C9000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 444	2788	rundll32.exe	14
PID 2788 wrote to memory of 444	2788	rundll32.exe	14
PID 2788 wrote to memory of 444	2788	rundll32.exe	14

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XMTS20090628\程序功能\CHJ006.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\XMTS20090628\程序功能\CHJ006.dll,#1
  2⤵
  PID:444

memory/444-0-0x0000000002250000-0x00000000022C9000-memory.dmp

Filesize
484KB

Download