bc1fee63f58691d2154ea024fe5bc4bd6dccedd986a0e3ac7a29161d0ba3d076

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 16:18

Target

c108be569bb47f4663716cd2d517929c.dll
Size

90KB
MD5

c108be569bb47f4663716cd2d517929c
SHA1

43e838039e112701bc30ca3ffe278ece9f89b24e
SHA256

bc1fee63f58691d2154ea024fe5bc4bd6dccedd986a0e3ac7a29161d0ba3d076
SHA512

3cf32b2da587a38f81bdaf8c56f38810bd9458537fe0fa8bcd583afa13578c8c1d27fc7cb4fd705dcd07e3aa57f7f946fd4bdc709050d9b67e198ed5d8e3dd71
SSDEEP

1536:WhVbLtdV5KC14wko4GdCDaEQqBUQ41hDbxOvvBb8opVw:WhVbJ14KDdCD6GUjxmvBAn

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2520-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 2520	4504	rundll32.exe	88
PID 4504 wrote to memory of 2520	4504	rundll32.exe	88
PID 4504 wrote to memory of 2520	4504	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c108be569bb47f4663716cd2d517929c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c108be569bb47f4663716cd2d517929c.dll,#1
  2⤵
  PID:2520

memory/2520-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download