5ea85ac874b09f5b8d48f1490926fa2997ea570a6c62ecdd901f883dd24dc792

Analysis

max time kernel
137s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 22:31

Target
BException.dll
Size 7KB
Sample240213-2ffg2aae9z
SHA256 7c6323205b69d6c3f95e1989dac6f7cf4a4aa66625a6b626085caa71372dedf8
MD5 00a9f8cc6fb5766e2b303e129d3ca96a
SHA1 52cd862b2c88b90b357fbece693a6d19cff656a7
SHA512 bef2606d181b0513157d5cdd8855ff6155f1c23b3e9c0d8b67a1f55238f471764a727dcde4e237d5c1da0dcd977cb2f1e91634c592806f02f164757280f07f07
SSDEEP 96:91zQ9iVDjkH0/s68dwJnAc7Tbuxuwb3fmqPQbAHoAxVmTzUuNTnT:9RQefG0/s61JAcTburJIRTzUQT
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3928-0-0x0000000010000000-0x000000001000B000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 3928	2040	rundll32.exe	84
PID 2040 wrote to memory of 3928	2040	rundll32.exe	84
PID 2040 wrote to memory of 3928	2040	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\BException.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\BException.dll,#1
  2⤵
  PID:3928

memory/3928-0-0x0000000010000000-0x000000001000B000-memory.dmp

Download