a07062cb5e0bc9f8f7250ba9f1b1e81641c96b74659af89da2da28b983a8cef4

Analysis

max time kernel
155s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 20:07

Target

XMTS20090628/程序功能/CHJ009.dll
Size

179KB
MD5

bc82f26285e6cb7a03cfda34c9f834f6
SHA1

13c9b2bc765fbec5e22786af3ff674df70dacf38
SHA256

914327ad06a80668f8b49dbae21dc5f81651c50ffaab0618ed973a3c35286026
SHA512

29f8e603127e5ef48515d1afe9e31e301664555ac1a41b90a1d2cf895a16cff37e43d4287bb6fd85371bad21ffafb1f43304cdbf3b112ee91248ceb9bb870f5d
SSDEEP

3072:oi1gP+ZpXLdOAyCB8BUjhbHSGqdDrbc6keHHhD7HZMNqjBXFNL9IGWiXr4WomtxR:N+P+ZdZtBZ9jRqdD6eHHhP5MN0B1NC/s

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral26/memory/2280-0-0x00000000007B0000-0x0000000000826000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2280	2904	rundll32.exe	85
PID 2904 wrote to memory of 2280	2904	rundll32.exe	85
PID 2904 wrote to memory of 2280	2904	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XMTS20090628\程序功能\CHJ009.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\XMTS20090628\程序功能\CHJ009.dll,#1
  2⤵
  PID:2280

memory/2280-0-0x00000000007B0000-0x0000000000826000-memory.dmp

Filesize
472KB

Download
memory/2280-1-0x00000000007B0000-0x0000000000826000-memory.dmp

Filesize
472KB

Download
memory/2280-2-0x00000000007B0000-0x0000000000826000-memory.dmp

Filesize
472KB

Download