ac9e9d23ed5e0470baa75d4044b1200179cb21f609c3ac3a7d2769c2f9f36e2c

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07-03-2024 16:59

Target

b934dd7be285b0bcee496d8ebebfb075.dll
Size

130KB
MD5

b934dd7be285b0bcee496d8ebebfb075
SHA1

d5148c8e0383221114e42e0b269ec0fab9d2bd97
SHA256

ac9e9d23ed5e0470baa75d4044b1200179cb21f609c3ac3a7d2769c2f9f36e2c
SHA512

1231d2f5cc0077e02de0039348c1549f4aae3d046e6b9c1a4c7843fa51195c3211ebe69cfc81b74fd127f8c9c8bea128f1197923cabd5614c44eb497876eb6d8
SSDEEP

1536:6Rw9k6k1FrHc5mlywhJNu85JZFX/sU8JHBQO2b/oChuzpl:/cHr8IywhrpX3Ahmb/op

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4076-0-0x0000000010000000-0x0000000010017000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 4076	948	rundll32.exe	89
PID 948 wrote to memory of 4076	948	rundll32.exe	89
PID 948 wrote to memory of 4076	948	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b934dd7be285b0bcee496d8ebebfb075.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b934dd7be285b0bcee496d8ebebfb075.dll,#1
  2⤵
  PID:4076

memory/4076-0-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download