c1814ae96627b231ecf1672771a1b8cbb614e1de590e4e5d6dc8e4b84995e7cb

Analysis

max time kernel
90s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
05/02/2024, 14:40

Target
9240392fa2b711bbbc4b0d5a7fc7e414.dll
Size 24KB
Sample240205-r1vgksabe2
SHA256 c1814ae96627b231ecf1672771a1b8cbb614e1de590e4e5d6dc8e4b84995e7cb
MD5 9240392fa2b711bbbc4b0d5a7fc7e414
SHA1 455af547231f861fa7629b529187a43a174573a7
SHA512 a7a8e94e594a0a9e4d54763996ba8f30f694d70099f25bb23f8893e94e635d3e013ec85268ce7c052162b7fec161fe80113effd82cacd185003ef7d70b68beb3
SSDEEP 384:VJl4a2PITj5c1f39hyw8NTvvPpTGNJEh7UV0HYGYYaQqB4Wl4p2:B4a2ioNhywwRaNJEhwV+YD6bWaU
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/216-0-0x0000000010000000-0x0000000010014000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 216	1132	rundll32.exe	84
PID 1132 wrote to memory of 216	1132	rundll32.exe	84
PID 1132 wrote to memory of 216	1132	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9240392fa2b711bbbc4b0d5a7fc7e414.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9240392fa2b711bbbc4b0d5a7fc7e414.dll,#1
  2⤵
  PID:216

memory/216-0-0x0000000010000000-0x0000000010014000-memory.dmp

Download