a74efdf5f4c431cc4484e12b9df9e7aea447e62837e46c7b61690a1ec152405b

Analysis

max time kernel
93s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2024, 02:44

Target

762d949babf8cba35afb854e95ef1e51.dll
Size

79KB
MD5

762d949babf8cba35afb854e95ef1e51
SHA1

d69d4e76cdb4068cd29d94fbb936124cd4a3bf28
SHA256

a74efdf5f4c431cc4484e12b9df9e7aea447e62837e46c7b61690a1ec152405b
SHA512

5149f5fb122052a99048fb093258d75e08449de7c5d2bda8cd99e927aa97c21a824738b41e4b0eae63a0ffae0aa07101df46e8329947e15d65355c8ef3f2cac0
SSDEEP

1536:DKMIguFe631RvrI6lpNtZ0t6mqkHcbFmH3Xo3ZsuSQi1bL8TfGA:DMd3bI6Hd0t6m3SFmH3XjuFi1fqfGA

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3572-0-0x0000000010000000-0x0000000010970000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 3572	4516	rundll32.exe	85
PID 4516 wrote to memory of 3572	4516	rundll32.exe	85
PID 4516 wrote to memory of 3572	4516	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\762d949babf8cba35afb854e95ef1e51.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\762d949babf8cba35afb854e95ef1e51.dll,#1
  2⤵
  PID:3572

memory/3572-0-0x0000000010000000-0x0000000010970000-memory.dmp

Filesize
9.4MB

Download
memory/3572-1-0x0000000010000000-0x0000000010970000-memory.dmp

Filesize
9.4MB

Download