a5f658d37346324438f0c2f479074669d22a11fa8e13a14f5f83d57c7ce2ab03

Analysis

max time kernel
141s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 14:10

Target

$TEMP/SDM143/resourceDll.dll
Size

171KB
MD5

5cf0fba9e8775382233c8e63e52c838a
SHA1

b2a092f71eff0f6916652d7f3bfde9204eda5636
SHA256

7d940af8950b106227539cd4bdfb62f2d37a4abeaf568ebe2275fd31058c2ca5
SHA512

73489e3638b98ffd7bd516bfed519cfd48758aaaedc11cb202d11822cad609caf9af95e9e864bd8a992be826945e6d018ce081f3970511fd49d7757ca6affd25
SSDEEP

3072:+ZY/h+iA4GaJfGZK2MiMq5dpNQA2Wj5vg/ySQGdXMd86a30GCooutkzjO:YWwqGaJfGZ1Mq5BRj2/yR8XMZ0CooSkz

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral18/memory/2548-0-0x0000000010000000-0x000000001009F000-memory.dmp	upx
behavioral18/memory/2548-1-0x0000000010000000-0x000000001009F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 2548	3712	rundll32.exe	94
PID 3712 wrote to memory of 2548	3712	rundll32.exe	94
PID 3712 wrote to memory of 2548	3712	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\resourceDll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\resourceDll.dll,#1
  2⤵
  PID:2548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1428 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:1980

memory/2548-0-0x0000000010000000-0x000000001009F000-memory.dmp

Filesize
636KB

Download
memory/2548-1-0x0000000010000000-0x000000001009F000-memory.dmp

Filesize
636KB

Download