545f14308861b994cacb28fa6ff25d2ff794bf3e9a7fb90355d7e890113aaf28

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 20:49

Target

d715444029d06f02e48254e3c12e6343.dll
Size

39KB
MD5

d715444029d06f02e48254e3c12e6343
SHA1

a71298d3c595ad048ed7c63338cad7e0716d9dd3
SHA256

545f14308861b994cacb28fa6ff25d2ff794bf3e9a7fb90355d7e890113aaf28
SHA512

207287c16e335f51cf31765b0427b0245f407abe78c5a774ef9d3837d3a102986684b3787003646fdeab40b4410919c67b217f2b392b519b6eeba5f8060ce4b6
SSDEEP

384:ClXCSPF51+zlWFMYDLeVRtgdpuS44IQbIxCGGtF9HYPJr26:CAUF5fuYuVR2PuS443QKzqrb

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/436-0-0x0000000000400000-0x0000000000412000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 436	4088	rundll32.exe	88
PID 4088 wrote to memory of 436	4088	rundll32.exe	88
PID 4088 wrote to memory of 436	4088	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d715444029d06f02e48254e3c12e6343.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d715444029d06f02e48254e3c12e6343.dll,#1
  2⤵
  PID:436

memory/436-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download