cf2f4e6c0fb8c4594f7fb11b910fb88eb79f03180c507460a9d2eb5d3e37b97c

Analysis

max time kernel
125s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 13:02

Target

9bbe466c038f2c201903dd2c0a69cb80.dll
Size

14KB
MD5

9bbe466c038f2c201903dd2c0a69cb80
SHA1

b014197dd21baf2985588f39991b9dc8980144df
SHA256

cf2f4e6c0fb8c4594f7fb11b910fb88eb79f03180c507460a9d2eb5d3e37b97c
SHA512

70c5e04867ffbee788571ed4bdbb07df088651233e2312b18a22d4deb1524976895b6fcee9bf2ae30ef3fad2606792e278f869978c4f68f7284a2997c9e1c4fa
SSDEEP

192:/+a8MFCBG2i4Gtf73cWu5u1oE5dgzUR6xCtIO2OROExfjDecAtQQvkcips:/k2Dtf73KeoEH/3KOoExf2cAtQGH

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1008-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 676 wrote to memory of 1008	676	rundll32.exe	85
PID 676 wrote to memory of 1008	676	rundll32.exe	85
PID 676 wrote to memory of 1008	676	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9bbe466c038f2c201903dd2c0a69cb80.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9bbe466c038f2c201903dd2c0a69cb80.dll,#1
  2⤵
  PID:1008

memory/1008-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download