a07062cb5e0bc9f8f7250ba9f1b1e81641c96b74659af89da2da28b983a8cef4

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 20:07

Target

XMTS20090628/程序功能/CHJ008.dll
Size

11KB
MD5

f079e9c9a0c3ce7eb6f149fa2d183176
SHA1

65756e0851931a130fd191c2a56b99c13161ec6e
SHA256

7c52af3109e8272360fccfe0914beef957f5f90e593c3ff214122bdcf0b8d75b
SHA512

a1035eb3881ebce626c3574ab421548aebe9487d3d8ec66a21527653e1a5607f49d3ac1b411298fedb8826defedabe621482c2d131053a27c5ae86657d3599db
SSDEEP

192:nvlThrhKMYrnuu5H2UE8x2AMAPiOYVgpYPmxn4Hhrw8CVNDsoKfGA:PrhIruu5HkgfMvVYYPmxwhIFpWG

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral24/memory/4944-0-0x0000000000400000-0x000000000040D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 4944	4088	rundll32.exe	19
PID 4088 wrote to memory of 4944	4088	rundll32.exe	19
PID 4088 wrote to memory of 4944	4088	rundll32.exe	19

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XMTS20090628\程序功能\CHJ008.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\XMTS20090628\程序功能\CHJ008.dll,#1
  2⤵
  PID:4944

memory/4944-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download