428a404ba6e0c010962563e46dcebec3c4ab9a322958987a4db4b05699c58782

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2024, 10:40

Target

a391bc67361266cae920888cd5b2e584.dll
Size

98KB
MD5

a391bc67361266cae920888cd5b2e584
SHA1

73bd68e6ba013597384c0c7104263f060a4a7729
SHA256

428a404ba6e0c010962563e46dcebec3c4ab9a322958987a4db4b05699c58782
SHA512

14ac1d8059b83f0a57cfff218d51e837d3323a4ba7f6050e774b95f6d63e9363f921d7c21a670e5aab0140f1973dc9cae782e353de673c35311b70e9ae7609d3
SSDEEP

1536:kqKlQnkeUs8C9DtpLwwP4kDBeKlBFNj7PvHwCZzTOHQdn1xSZ/NZoFsT:k5g8C/xDkKtB7PvQCZuHqs/AY

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4128-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 4128	4692	rundll32.exe	87
PID 4692 wrote to memory of 4128	4692	rundll32.exe	87
PID 4692 wrote to memory of 4128	4692	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a391bc67361266cae920888cd5b2e584.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a391bc67361266cae920888cd5b2e584.dll,#1
  2⤵
  PID:4128

memory/4128-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download