73202e8d754c4cf8900775eedb4e8c9d80d6df31d8db4aa75327aa8bdaff33c7

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/01/2024, 14:16

Target

800b4f959096fb2fb538bb12c8afacb2.dll
Size

85KB
MD5

800b4f959096fb2fb538bb12c8afacb2
SHA1

9bf6c00c65c483d79548b29f1a390b1faf68b5bb
SHA256

73202e8d754c4cf8900775eedb4e8c9d80d6df31d8db4aa75327aa8bdaff33c7
SHA512

eae55dae8c0c2e3addbc2ee6c5671e3d0120e5ea6f1f21879fbe0be72612ae3cacf8d3dbf058cf53dfcd85b265e8701a907b70cff16c552423eca074f55e45d6
SSDEEP

1536:SAVJ0mWeB/iU9D8n+uiVoU5Pli5gMqygq8XcBqkxR+OM4HDlOUw9:zJ0mW8/inq5lsgQgrmquR+IjlJw9

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4080-0-0x0000000010000000-0x000000001000C000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 4080	4760	rundll32.exe	84
PID 4760 wrote to memory of 4080	4760	rundll32.exe	84
PID 4760 wrote to memory of 4080	4760	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\800b4f959096fb2fb538bb12c8afacb2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\800b4f959096fb2fb538bb12c8afacb2.dll,#1
  2⤵
  PID:4080

memory/4080-0-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download