96e88d1036ca08dd8e3d7ef5222c5dca5ffd2b00e6e3dd69e7027ee1a8edc08e

Analysis

max time kernel
138s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2024, 14:35

Target

4.2版不限速下载修GC/PanData/script/lib/lcurl.dll
Size

82KB
MD5

a99d3aa45356ce3fa2e3e49f539b8611
SHA1

4abca01699730e07c6f01c07f80ec310f8adce3b
SHA256

ade2bb29740171f33b7ed1e1d90eca497e410e9f189826784de9896eac436802
SHA512

1631533adb01257a42e9b144b7e78af26f896b4363e263b237ce5b47a8636182f5b1eed4fe02a3d81af44e2ced18f2e410d741fc266178abe990faa86211b867
SSDEEP

1536:GEpufnB0Sa+Au+QOYYfxmVodeijt/YkdQDw5mYX:GEpuPB0/+5+QQ0VodeipoDw5m

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral8/memory/1016-0-0x00000000755F0000-0x000000007562B000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 1016	396	rundll32.exe	18
PID 396 wrote to memory of 1016	396	rundll32.exe	18
PID 396 wrote to memory of 1016	396	rundll32.exe	18

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4.2版不限速下载修GC\PanData\script\lib\lcurl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4.2版不限速下载修GC\PanData\script\lib\lcurl.dll,#1
  2⤵
  PID:1016

memory/1016-0-0x00000000755F0000-0x000000007562B000-memory.dmp

Filesize
236KB

Download