eed96f3c8a914a822b72ef1a2c8cfbe27c36a84d5ce884534cc2378e60eb8b43

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2024, 02:13

Target

761dca563c17b6150a69faf8bc4c813f.dll
Size

82KB
MD5

761dca563c17b6150a69faf8bc4c813f
SHA1

28ceceac7d1a66e552451bb72c00d02e7f72d1c7
SHA256

eed96f3c8a914a822b72ef1a2c8cfbe27c36a84d5ce884534cc2378e60eb8b43
SHA512

9428add293144ea3b7a9c1794739a75074d4eb54f372a026e0a45c00c0cd1cff9bcacb7ece59cc8e18ef5b9a2fce0046a093c30061552726bd333b00e5abd034
SSDEEP

1536:NKLIZ8vX3pwCPqI7l2+Zg01KRtGMbKUcXbh5wAlfpmM:EL9vX3pvPqI7l2+ZgftGQXcrhlF

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3172-0-0x0000000010000000-0x000000001000B000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 3172	116	rundll32.exe	85
PID 116 wrote to memory of 3172	116	rundll32.exe	85
PID 116 wrote to memory of 3172	116	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\761dca563c17b6150a69faf8bc4c813f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\761dca563c17b6150a69faf8bc4c813f.dll,#1
  2⤵
  PID:3172

memory/3172-0-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download