ca752aecc85201b01e7fc540ae803c9fe591683b80688254640d9cd97a14c926

Analysis

max time kernel
89s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13-02-2024 11:19

Target

994a71086e087cd8036208dace1f9655.dll
Size

60KB
MD5

994a71086e087cd8036208dace1f9655
SHA1

1fb04a08edf452c36921b3ab99559aaee6176697
SHA256

ca752aecc85201b01e7fc540ae803c9fe591683b80688254640d9cd97a14c926
SHA512

33fb681dd4b245ba257e30e4b9c02fd560b798bbdb1640a700b8f795de25c4aea79cbfc7906240153af4ecebbff32da1d7a6cd43cea650e70cc9e5940b49c891
SSDEEP

768:m+YlPqpYYevVxo5fH5CbLqsnUazwEAjVrnsGCPgO642preBnTgrmt9i9e/24MRoi:tDhkLVzw/B7QYD42preBTg7b

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2020-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 2020	4120	rundll32.exe	87
PID 4120 wrote to memory of 2020	4120	rundll32.exe	87
PID 4120 wrote to memory of 2020	4120	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\994a71086e087cd8036208dace1f9655.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\994a71086e087cd8036208dace1f9655.dll,#1
  2⤵
  PID:2020

memory/2020-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download