5d16c5c364fd4fc9e2fcca0368b8858d95411127171807895d014de639d19ac6

Analysis

max time kernel
89s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 11:03

Target

c876f2bb8c8a7be771068374adf067cc.dll
Size

69KB
MD5

c876f2bb8c8a7be771068374adf067cc
SHA1

c8efe877915e85d4910860eb6c9b2db6a473b5a5
SHA256

5d16c5c364fd4fc9e2fcca0368b8858d95411127171807895d014de639d19ac6
SHA512

76694f0f42ad778bfa672f3d9c8a3cc1004d2688f160acc323b4fe5c2523e41236cb848d7e866baf1eee32039556253e5de6495356ab8a94d82580c6d983d3fb
SSDEEP

1536:5yoC1RPeEhS+RkEUUIOVZFt0OkDUgBX+YrpF30Ju8bb2MH:kowNspUQOkIgYs6JV2a

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/828-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 828	4812	rundll32.exe	88
PID 4812 wrote to memory of 828	4812	rundll32.exe	88
PID 4812 wrote to memory of 828	4812	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c876f2bb8c8a7be771068374adf067cc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c876f2bb8c8a7be771068374adf067cc.dll,#1
  2⤵
  PID:828

memory/828-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download