397324b81d5878e8669a1fb421885844ec1ff6033efe49b80635ad1cd14287ba

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 13:41

Target

a1fd7449415020d35258346bf0c10f88.dll
Size

78KB
MD5

a1fd7449415020d35258346bf0c10f88
SHA1

cf3d617e39f3bf7c3c5b457a9deded86211b3e10
SHA256

397324b81d5878e8669a1fb421885844ec1ff6033efe49b80635ad1cd14287ba
SHA512

350da350f0e8451de83840a74fb16accf8d2431e9393e196c7cb16fa3027f54e77b0d4b2d58fd85faf83639a42d93deaf4d1548145036fa719ae41708723370c
SSDEEP

1536:Bm1NGJVGXf5xF8EpVaao54f1pnX6e7KwPRs5sQ/V2ZVH:kX0Vwf5xmEjaaU4Xqe+fs6V2Z1

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2972-0-0x0000000010000000-0x0000000010013000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2972	2896	rundll32.exe	88
PID 2896 wrote to memory of 2972	2896	rundll32.exe	88
PID 2896 wrote to memory of 2972	2896	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1fd7449415020d35258346bf0c10f88.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1fd7449415020d35258346bf0c10f88.dll,#1
  2⤵
  PID:2972

memory/2972-0-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download