2a07f809dd1a2ccb14dbe4905405d0ef31c2d6a550dd61d3252a4633347b1c31

Analysis

max time kernel
90s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26-01-2024 02:45

Target

762e402e78eedcb591cb97d2e0dc63ec.dll
Size

10KB
MD5

762e402e78eedcb591cb97d2e0dc63ec
SHA1

43fed36b1e5a89572b19ba767b40d1d1be952ba6
SHA256

2a07f809dd1a2ccb14dbe4905405d0ef31c2d6a550dd61d3252a4633347b1c31
SHA512

612bf5f3c4f3b3592bab193195f4b3648e97340af73139499ef711855d0aa2c4199bd4f5eaa943ec10538add4bf224aba928c2b9b3a29475200e1e6d49daa4d0
SSDEEP

192:fZp7q4lTbynmtbw3MkOpaqR3IRa15NmNq8wiI1qrD6aAwwSWINW:fZNtlKnmGMbaq+Ru5NV8s1qrD6aAwTWz

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3100-0-0x0000000010000000-0x000000001000C000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 3100	2504	rundll32.exe	85
PID 2504 wrote to memory of 3100	2504	rundll32.exe	85
PID 2504 wrote to memory of 3100	2504	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\762e402e78eedcb591cb97d2e0dc63ec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\762e402e78eedcb591cb97d2e0dc63ec.dll,#1
  2⤵
  PID:3100

memory/3100-0-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download