6efea7882d4681a6cb80fd8ddffe7e369cda01f79fa5de722b3f4598b4404e15

Analysis

max time kernel
129s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2024, 12:13

Target

7753693f798bcc5cc7fefd9eb9c8670f.dll
Size

56KB
MD5

7753693f798bcc5cc7fefd9eb9c8670f
SHA1

20119b1b6101c94f1c8e4d91b8737be61d2935a5
SHA256

6efea7882d4681a6cb80fd8ddffe7e369cda01f79fa5de722b3f4598b4404e15
SHA512

960dbfd527dc62bb3bbf231356004e0613643b3392a2352015022bae7a3b976094cfc3d82260497dab29d76378a8bd91481e73efeb25b2da78750f6b508e38fe
SSDEEP

768:n7S7ILNPpMSqUCA+AJBMJsWHJppYJpEaB2QkL5ot3UvL7tb5cPvfqmLgtmyeulKg:n7ZLNPp9pZBMHOqdN5cPvCHtvvJ

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2876-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 2876	4940	rundll32.exe	86
PID 4940 wrote to memory of 2876	4940	rundll32.exe	86
PID 4940 wrote to memory of 2876	4940	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7753693f798bcc5cc7fefd9eb9c8670f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7753693f798bcc5cc7fefd9eb9c8670f.dll,#1
  2⤵
  PID:2876

memory/2876-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download