7f8f2cb0e0c9a46356630302a5bbe7ad4c0187024e142ba1cc0a1f1b2de9f9a2

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2024, 11:16

Target

a3a4724105a98784aeeb14ad26714533.dll
Size

19KB
MD5

a3a4724105a98784aeeb14ad26714533
SHA1

0509b6750f7561c8af660b6869a2e2e4c5c57128
SHA256

7f8f2cb0e0c9a46356630302a5bbe7ad4c0187024e142ba1cc0a1f1b2de9f9a2
SHA512

88b2abc42237d5632d79b21e781c964b4fc17b6be67c0408f29e591424ce152d018c64d1dc1a4c96eda01d95b603b81862d2e4c24cee6710eb671f34bf008da6
SSDEEP

384:GyMRx7xp0TIuo7JjDJhrbj5ihnrqucCwLAw3IR7DD:GyMH7xp0UnVjDrrbj5ihnrqvCw4HD

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2716-0-0x0000000010000000-0x0000000010012000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2716	2768	rundll32.exe	29
PID 2768 wrote to memory of 2716	2768	rundll32.exe	29
PID 2768 wrote to memory of 2716	2768	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a4724105a98784aeeb14ad26714533.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a4724105a98784aeeb14ad26714533.dll,#1
  2⤵
  PID:2716

memory/2716-0-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download