83fe33448f49df727782116f3e45f58616dfb2fa2e86c232b84f66aabca9e93e

Analysis

max time kernel
138s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 15:27

Target

7d5620af82135aab6764b61a3402cb20.dll
Size

113KB
MD5

7d5620af82135aab6764b61a3402cb20
SHA1

077d966140e72c915663aceb427162cd2b36d206
SHA256

83fe33448f49df727782116f3e45f58616dfb2fa2e86c232b84f66aabca9e93e
SHA512

a8bf2119fcdfeff2c1172bd7815ab7e5ad845400cc52b0038bda2cdb0b2f996bf04f317d93601b462458555d7ffc423b5be97ffd73706d4c35bbec3c086e76cd
SSDEEP

1536:/ePxCUjeSp7qrnhBbgA6U7eLKe7XPwtGB5Ju9MaDaEiHtzMCfnx5:WPxpuLhl6P7fb3JuSnNgCr

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1772-0-0x0000000010000000-0x0000000010013000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 1772	4980	rundll32.exe	86
PID 4980 wrote to memory of 1772	4980	rundll32.exe	86
PID 4980 wrote to memory of 1772	4980	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d5620af82135aab6764b61a3402cb20.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d5620af82135aab6764b61a3402cb20.dll,#1
  2⤵
  PID:1772

memory/1772-0-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download