5cfc4d0e4f658a0605ecbd5d397df04c707c9a5fe2efe11b4907ab1ca9d3ad42

Analysis

max time kernel
93s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 04:26

Target

8b64f6d0d9d2ea10d2a9886ad54cc18b.dll
Size

104KB
MD5

8b64f6d0d9d2ea10d2a9886ad54cc18b
SHA1

b28ab9569e576f5b3e4fc611c5e536e3348b9d0d
SHA256

5cfc4d0e4f658a0605ecbd5d397df04c707c9a5fe2efe11b4907ab1ca9d3ad42
SHA512

78d3b1348c7369723eb25931ed88fe2ed2371149e78c1064189ebd45d765be291e570dddc3f9eef56b833b449015918d9e10c12e7c359917434fb049f65fd0d3
SSDEEP

1536:4G3uk8hPgcW3cunhBbgA6Ut5v8LS3bAdKDjzioE7XE4SGbOvCE:13sL6Dh75v8mkdKDjzioESaE

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2976-0-0x0000000010000000-0x0000000010013000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 2976	1156	rundll32.exe	84
PID 1156 wrote to memory of 2976	1156	rundll32.exe	84
PID 1156 wrote to memory of 2976	1156	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8b64f6d0d9d2ea10d2a9886ad54cc18b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8b64f6d0d9d2ea10d2a9886ad54cc18b.dll,#1
  2⤵
  PID:2976

memory/2976-0-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download