ce8a34f6e5895eee8add7478199713a2750eb788e9eaaa22392822d0aa72da11

Analysis

max time kernel
124s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-03-2024 00:15

Target

bd2c09968a1c620e9f4ca8de2db5fb2b.dll
Size

77KB
MD5

bd2c09968a1c620e9f4ca8de2db5fb2b
SHA1

a11cf61fb27ac4e327acbd5bde9dacd2cc1389fc
SHA256

ce8a34f6e5895eee8add7478199713a2750eb788e9eaaa22392822d0aa72da11
SHA512

7e9b3cd249a637f06a08573e6b9b07d6aebbda6a63c949cc480e2df7aed8f90052c575ac8d4139b2173c287c8cbb635fa1baa281dabf1cadf4e31ea1958a19f5
SSDEEP

768:tqGhkGeP6Vaay9Gy06nY0d+A9o9jwRn8cArRyRKhmwZhII5nLq72mcDhX+igksjJ:tbOd06nY+60dZihv0wDhr6fcWPZ

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1628-0-0x0000000010000000-0x000000001000B000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 1628	1900	rundll32.exe	94
PID 1900 wrote to memory of 1628	1900	rundll32.exe	94
PID 1900 wrote to memory of 1628	1900	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd2c09968a1c620e9f4ca8de2db5fb2b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd2c09968a1c620e9f4ca8de2db5fb2b.dll,#1
  2⤵
  PID:1628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4052 --field-trial-handle=3084,i,11997299123381683778,5904351605020331957,262144 --variations-seed-version /prefetch:8
1⤵
PID:3284

memory/1628-0-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download