a07062cb5e0bc9f8f7250ba9f1b1e81641c96b74659af89da2da28b983a8cef4

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 20:07

Target

XMTS20090628/程序功能/CHJ007.dll
Size

11KB
MD5

707b409316f0b24851750bd7bfa01cca
SHA1

49edad504031c2e8279e860f2d58723a4d65cae3
SHA256

272d943a0b6dd4558700490701589fd8c4ea45d2f83932b5ee5a72fe0afdb724
SHA512

082471cfd153ea3150ca2248d7469526388ebd6c5325e23b4068196cc4992def161e79f05a8c4b4943f8e66b41362c8ac201a9c23a15334ce87fde13a0458110
SSDEEP

192:n6nlThrhKMYrnuu5H2UE8x2AMAPiOYVgpYPmxn4Hhrw8q/a/qJ/P7A:crhIruu5HkgfMvVYYPmxwhO/aiV7

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral22/memory/860-0-0x0000000000400000-0x000000000040D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 860	4172	rundll32.exe	86
PID 4172 wrote to memory of 860	4172	rundll32.exe	86
PID 4172 wrote to memory of 860	4172	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XMTS20090628\程序功能\CHJ007.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\XMTS20090628\程序功能\CHJ007.dll,#1
  2⤵
  PID:860

memory/860-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download