1b866193142341a2480c58f5633ab4e57b0587a101514946480f1607ebbfc895

Analysis

max time kernel
91s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26-01-2024 03:57

Target

76528ee95e806aaff20aa91d1b54c447.dll
Size

56KB
MD5

76528ee95e806aaff20aa91d1b54c447
SHA1

3b1507f44918d866cce34ced3cc49fa2d5c515cf
SHA256

1b866193142341a2480c58f5633ab4e57b0587a101514946480f1607ebbfc895
SHA512

2a7091766c951842e9b9de39aff32e6e0e978c655db2d2029e96178fa5d9a6dd9dc8f4f3d1f56468bc46104dd0571c031fdab3050d2625a40182f52d33faeba6
SSDEEP

768:GbvLDaaMact8TfqbAJSGqJPHl3Pv7A8eZrr7v1wGIAthnB6ocgMnVAz:evxSGqpl88u+NAjnB5cZnW

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1400-0-0x0000000010000000-0x000000001000C000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 1400	864	rundll32.exe	87
PID 864 wrote to memory of 1400	864	rundll32.exe	87
PID 864 wrote to memory of 1400	864	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\76528ee95e806aaff20aa91d1b54c447.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\76528ee95e806aaff20aa91d1b54c447.dll,#1
  2⤵
  PID:1400

memory/1400-0-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download