0483b6fd2bd022fef07bf2509a2351292736966b975e68368cdb36bd4bd53c94

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 11:01

Target

df011fbfde579d65a82d9903fd92c362.dll
Size

64KB
MD5

df011fbfde579d65a82d9903fd92c362
SHA1

748254707a0e80690194494e3dc3503bb4b1017f
SHA256

0483b6fd2bd022fef07bf2509a2351292736966b975e68368cdb36bd4bd53c94
SHA512

a54f1193ee667f3f896cc1d1c7877550b68a68dbf3ed27f1e0719373690eb21c8831cd57d9b2136a461df2ddd8f134419b3a86e18b66ab119338a7dd24a8e0ec
SSDEEP

1536:F1WCNpXfmefiUIL1twqbhqdLR8zNJVrWYUAhSpDID:fpfiLUqbUGzHVrWl+SpDID

Score

7^/10

upx

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4800-0-0x00000000009D0000-0x00000000009DE000-memory.dmp	upx
behavioral2/memory/4800-5-0x00000000009D0000-0x00000000009DE000-memory.dmp	upx
behavioral2/memory/4800-4-0x00000000009D0000-0x00000000009DE000-memory.dmp	upx
behavioral2/memory/4800-6-0x00000000009D0000-0x00000000009DE000-memory.dmp	upx
behavioral2/memory/4800-7-0x00000000009D0000-0x00000000009DE000-memory.dmp	upx
behavioral2/memory/4800-8-0x00000000009D0000-0x00000000009DE000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 4800	4984	rundll32.exe	88
PID 4984 wrote to memory of 4800	4984	rundll32.exe	88
PID 4984 wrote to memory of 4800	4984	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\df011fbfde579d65a82d9903fd92c362.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\df011fbfde579d65a82d9903fd92c362.dll,#1
  2⤵
  PID:4800

memory/4800-0-0x00000000009D0000-0x00000000009DE000-memory.dmp

Filesize
56KB

Download
memory/4800-1-0x00000000009B0000-0x00000000009B6000-memory.dmp

Filesize
24KB

Download
memory/4800-5-0x00000000009D0000-0x00000000009DE000-memory.dmp

Filesize
56KB

Download
memory/4800-4-0x00000000009D0000-0x00000000009DE000-memory.dmp

Filesize
56KB

Download
memory/4800-6-0x00000000009D0000-0x00000000009DE000-memory.dmp

Filesize
56KB

Download
memory/4800-7-0x00000000009D0000-0x00000000009DE000-memory.dmp

Filesize
56KB

Download
memory/4800-8-0x00000000009D0000-0x00000000009DE000-memory.dmp

Filesize
56KB

Download