512b66387a468d0b4996d8b335fe81fba8f12eff1352f5f11707d1ca593105d5

Analysis

max time kernel
109s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 14:07

Target

97553d0a558d5f01fcb4420e4c2b1079.dll
Size

61KB
MD5

97553d0a558d5f01fcb4420e4c2b1079
SHA1

07228da4156c6efeb2f234f6183996a8b6a83428
SHA256

512b66387a468d0b4996d8b335fe81fba8f12eff1352f5f11707d1ca593105d5
SHA512

01a7a0d285bb839e8e4d3831acce51d09512cda4e78ee638905dbe9b6e9ce122893c6dc8034e1c1eb6207226d3376c5f700c9bc629d384ca18a97cbad7fe0acb
SSDEEP

1536:TTHe9FMUda1ATLkChbU5tnelb9Mj/inSlJMdpdlqSdY:nHuK1Q48YPnelbSLyI8bO

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4608-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 4608	3236	rundll32.exe	85
PID 3236 wrote to memory of 4608	3236	rundll32.exe	85
PID 3236 wrote to memory of 4608	3236	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\97553d0a558d5f01fcb4420e4c2b1079.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\97553d0a558d5f01fcb4420e4c2b1079.dll,#1
  2⤵
  PID:4608

memory/4608-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download