a07062cb5e0bc9f8f7250ba9f1b1e81641c96b74659af89da2da28b983a8cef4

Analysis

max time kernel
130s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 20:07

Target

XMTS20090628/程序功能/CHJ012.dll
Size

401KB
MD5

6f337fee89f55a8ebe3cb3ad8ecc1b99
SHA1

4a2ff85ad7cae4276a4fcb6b8c1b09ab4029d432
SHA256

791b83d03b94e34f35050b1d4adceeef381ba33365855f635cabda265f7a6439
SHA512

a51635b8b072cf52ce9ad9df3ed551c1cca8389685eb482f23920f3ed7797d352f1fedbacffa3301f9ede4b6071cd3c5cc6b415431ed798416e5b08c33fa2354
SSDEEP

6144:HuOf4U8sy3lswkm5snLoiZKlOXaayzlFV9irWtTQQvAB69MpVnpQ9v:HfalkKcaai9irWSgG62pvQ

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral30/memory/3876-1-0x00000000020A0000-0x000000000219D000-memory.dmp	upx
behavioral30/memory/3876-0-0x00000000020A0000-0x000000000219D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 3876	536	rundll32.exe	85
PID 536 wrote to memory of 3876	536	rundll32.exe	85
PID 536 wrote to memory of 3876	536	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XMTS20090628\程序功能\CHJ012.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\XMTS20090628\程序功能\CHJ012.dll,#1
  2⤵
  PID:3876

memory/3876-1-0x00000000020A0000-0x000000000219D000-memory.dmp

Filesize
1012KB

Download
memory/3876-0-0x00000000020A0000-0x000000000219D000-memory.dmp

Filesize
1012KB

Download