e601c8f7d7807dda184c4f8798770f246621a82e418cbbf7908ff340e155bf6f

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 07:21

Target

d588d000dc2e75a35245b34ff610420b.dll
Size

12KB
MD5

d588d000dc2e75a35245b34ff610420b
SHA1

db09418290145c703013e3e94eebf47f4313bcff
SHA256

e601c8f7d7807dda184c4f8798770f246621a82e418cbbf7908ff340e155bf6f
SHA512

758aedcc7e8cd7e40159110ea7f191cdd801a65ee470d4157940c5ddc6c537c78bf76ef52ed8cc65c10b2c445197077df68f634e92b803150393622f11884cec
SSDEEP

192:DDXcZ35QSB2aFjZoxtxrOrjEzNl7UMFxpSK5kCo+imBxqssHqJ23l8LgbVTpWJn:DD05QSlGxr7kMJ22dvsKJ23hbVTpW

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4648-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 4648	4800	rundll32.exe	87
PID 4800 wrote to memory of 4648	4800	rundll32.exe	87
PID 4800 wrote to memory of 4648	4800	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d588d000dc2e75a35245b34ff610420b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d588d000dc2e75a35245b34ff610420b.dll,#1
  2⤵
  PID:4648

memory/4648-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download