ca752aecc85201b01e7fc540ae803c9fe591683b80688254640d9cd97a14c926

Analysis

max time kernel
89s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 11:19

Target
994a71086e087cd8036208dace1f9655.dll
Size 60KB
Sample240213-nfbl7ahf57
SHA256 ca752aecc85201b01e7fc540ae803c9fe591683b80688254640d9cd97a14c926
MD5 994a71086e087cd8036208dace1f9655
SHA1 1fb04a08edf452c36921b3ab99559aaee6176697
SHA512 33fb681dd4b245ba257e30e4b9c02fd560b798bbdb1640a700b8f795de25c4aea79cbfc7906240153af4ecebbff32da1d7a6cd43cea650e70cc9e5940b49c891
SSDEEP 768:m+YlPqpYYevVxo5fH5CbLqsnUazwEAjVrnsGCPgO642preBnTgrmt9i9e/24MRoi:tDhkLVzw/B7QYD42preBTg7b
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2020-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 2020	4120	rundll32.exe	87
PID 4120 wrote to memory of 2020	4120	rundll32.exe	87
PID 4120 wrote to memory of 2020	4120	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\994a71086e087cd8036208dace1f9655.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\994a71086e087cd8036208dace1f9655.dll,#1
  2⤵
  PID:2020

memory/2020-0-0x0000000010000000-0x000000001000E000-memory.dmp

Download