a07062cb5e0bc9f8f7250ba9f1b1e81641c96b74659af89da2da28b983a8cef4

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 20:07

Target

XMTS20090628/程序功能/CHJ013.dll
Size

181KB
MD5

99ee172c8c8cd3e599807f1ff8ccf8e2
SHA1

81a8f6f9c1af048d1d2fbef587a57fb07e41947d
SHA256

7beaed15832fe705872da1a3b200a967cf1d8ea7ddb59e64469110de9f2d3e63
SHA512

d2830851eb85bf8628228b4cb55e6bd3a50310e21fcf2c0bf24f760e094dfaf1efe343781996895350170b53455794df84a726ff877bc841c1c5cc2a8b70e84e
SSDEEP

3072:KDyarutgQtt+3RAinbFxCX7uMxjYr4eZebGRUqpTNgb4hkHs8w9oz2mubVhaYGe:FkYr0hAabDG7uSjAebuUqpTNgshKZwC2

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral31/memory/2124-0-0x0000000001B90000-0x0000000001C05000-memory.dmp	upx
behavioral31/memory/2124-1-0x0000000001B90000-0x0000000001C05000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2124	2332	rundll32.exe	28
PID 2332 wrote to memory of 2124	2332	rundll32.exe	28
PID 2332 wrote to memory of 2124	2332	rundll32.exe	28
PID 2332 wrote to memory of 2124	2332	rundll32.exe	28
PID 2332 wrote to memory of 2124	2332	rundll32.exe	28
PID 2332 wrote to memory of 2124	2332	rundll32.exe	28
PID 2332 wrote to memory of 2124	2332	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XMTS20090628\程序功能\CHJ013.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\XMTS20090628\程序功能\CHJ013.dll,#1
  2⤵
  PID:2124

memory/2124-0-0x0000000001B90000-0x0000000001C05000-memory.dmp

Filesize
468KB

Download
memory/2124-1-0x0000000001B90000-0x0000000001C05000-memory.dmp

Filesize
468KB

Download