cb2b5d2458890342b322ee6d1dc9005ff2d0dc5993770b6803429e201baf3ac5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 15:55

Target

b51614373059edbae403481ccf25b5fb.dll
Size

130KB
MD5

b51614373059edbae403481ccf25b5fb
SHA1

ee09eeba7be380e2c2864cd8cfed9f1f323c6151
SHA256

cb2b5d2458890342b322ee6d1dc9005ff2d0dc5993770b6803429e201baf3ac5
SHA512

a266b6a73366edd11ef28fb6fc9f8815a8cd4d69e79dc2f0fd0d29190300cb22a6a45176316ccec213aece046ed9dc73e5a94f118e8ec3fc69af2369e798582f
SSDEEP

1536:PpEFUaLBF/H8MeVpBvlqAnJKK+e4n2nnxFTTDKZYielt12dHQT:izj/czVpBvcAncK+e4mxFTTDLt1WHq

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4668-0-0x0000000010000000-0x0000000010017000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 4668	4428	rundll32.exe	89
PID 4428 wrote to memory of 4668	4428	rundll32.exe	89
PID 4428 wrote to memory of 4668	4428	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b51614373059edbae403481ccf25b5fb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b51614373059edbae403481ccf25b5fb.dll,#1
  2⤵
  PID:4668

memory/4668-0-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download