6c1da2b12d813f7455f32393e659211e1e9a2bdf5ce5aa4227cbf8117c8bd4e7

Analysis

max time kernel
137s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04-02-2024 08:34

Target

8eb220fbf138bbd3fb39718ac06e6812.dll
Size

66KB
MD5

8eb220fbf138bbd3fb39718ac06e6812
SHA1

d85c1a0466a28828b1ac68b6dd84b949b9731e33
SHA256

6c1da2b12d813f7455f32393e659211e1e9a2bdf5ce5aa4227cbf8117c8bd4e7
SHA512

9e5c1c05ea1f5f5ecac7b196de702f1c27f3dc44b6ed24c0460493698ada58a4ad76755133c5d9be0fc81a80c23abe080675e8eebaf86fca7040ce75338d2c14
SSDEEP

1536:YqCQXmVONA/NRs85+68b811n/d+W22lSyvG4zrbiNMOzuzM/Kn5:JCQ2QOj+6Q0/d+W20HoMrgi5

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1844-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 1844	3448	rundll32.exe	83
PID 3448 wrote to memory of 1844	3448	rundll32.exe	83
PID 3448 wrote to memory of 1844	3448	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8eb220fbf138bbd3fb39718ac06e6812.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8eb220fbf138bbd3fb39718ac06e6812.dll,#1
  2⤵
  PID:1844

memory/1844-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download